Problem: A security vulnerability has been discovered in Winfrasoft Winfrasoft X-Forwarded-For for ISA Server which could result in a denial of service. A successful delivery of the attack could leave the ISA Server Firewall service in a stopped state preventing ISA Server from serving traffic. No nauthorised access is gained or compromised.
All versions of Winfrasoft X-Forwarded-For for ISA Server up to and including 2.0.4. This also includes prior version 1.x builds.
The risk of attack is greatest where ISA Server is being used as a reverse proxy as inbound access from the Internet is allowed. If ISA Server is being used as a forward proxy server then the attack could only be launched from the internal network which poses a much lower risk. The only method of mitigating the issue without upgrading to the new version is to disable or ninstall X-Forwarded-For for ISA Server.
An updated version of Winfrasoft X-Forwarded-For for ISA Server has released which corrects the issue. The security fix is included in all builds from, and including version 2.0.6.
Winfrasoft was privately notified about the issue, and under "responsible disclosure guidelines" we shall not be detailing exact attack methodology. The attack has been publically exploited in the wild although it is not known if this was specifically an attack targeted against Winfrasoft X-Forwarded-For for ISA Server.
Further details and guidance regarding discontinuation of TMG Web Protection Services - As discussed in the following blog, the Forefront Threat Management Gateway (TMG) Web Protection Services will be discontinued on December 31st, 2015:- htt...
5 years ago