Security (MS)

I'm not sure why there was a design decision to reserve so many UDP ports to take care of the DNS security fix (KB 953230). Thankfully, you can reserve ports that you know a service will need after the DNS Service starts up and you can also specify how many ports are reserved. I'm surprised a few of these well known ports aren't already reserved by default.

You can read how to work around this issue here at KB 956188. So far I have seen and heard it affecting ISA 200x, Exchange and a few other products that need well known UDP ports to operate correctly. I highly suspect but haven't confirmed that an OCS A/V Edge server will need reservations to avoid DNS stealing from its pool. Considering most edge installations are in a DMZ and/or a security hardened install, 99.99% of the installs out there will not be running the DNS Server service anyway.

This sounds a lot like the Home Server bug that was finally fixed in the Power Pack 1 release.

SYMPTOMS
Data corruption may occur on a computer that has Microsoft Forefront Client Security (FCS) installed. When this data corruption occurs, you may experience the following symptoms.

CAUSE
This problem occurs because of a known issue of cache coherency between mapped I/O requests and non-cached I/O requests. Forefront Client Security real-time protection uses memory mapped I/O requests for scanning files. This problem affects non-cached I/O requests. It may cause data corruption or cause truncation operations to be unsuccessful.

Special note to Server 2008 core installations: You need to install this manually - read more about it here.

Although I will admit I am biased against ZoneAlarm due to prior problems I've had with the product in the past, the July 2008 MS Security patch related to a DNS exploit does not 'play well' with the ZoneAlarm software. It is highly recommended that you download the updated version of ZoneAlarm from here before installing the security patch from KB 951748.

The initial knee jerk reaction to this problem might be to uninstall KB 951748, but I would advise against that due to the fact that there is an updated version of ZoneAlarm available.

Personally I am more of a fan of ESET's security suite and I have also had good experiences with Comodo's personal firewall, which is free. Of course, despite having a bit of a bad reputation in the past, the built in Windows Firewall isn't half bad these days either. You can even do per-process outbound blocking with Windows Live OneCare and the updated firewall in Vista and Server 2008 is much more feature-ful than what was included in XP.

Currently I'm "dogfooding" builds of the Forefront Threat Management Gateway at home on my EVDO connection and all the devices in our home are the clients. It is what would normally be called ISA 2008 or ISA 2009, renamed. The differences between ISA 2004 and ISA 2006 were pretty minimal, overall, for a compelling reason to upgrade from 2004 to 2006, but this version has a lot going for it, including Snort-like blocking signatures and other additions.

Microsoft Source Code Analyzer for SQL Injection is a static code analysis tool for finding SQL Injection vulnerabilities in ASP code. Customers can run the tool on their ASP source code to help identify code paths that are vulnerable to SQL Injection attacks.

A handy tool to use to check over code to help prevent the nasty automated attacks that have been occurring against sites on the Internet.

Grab it from here.

New features and feature improvements:

Configuration Change Tracking - Registers all configuration changes applied to ISA Server to help you assess issues that may occur as a result of these changes.

Test Button - Tests the consistency of a Web publishing rule between the published server and ISA Server.

Traffic Simulator - Simulates network traffic in accordance with specified request parameters, such as an internal user and the Web server, providing information about firewall policy rules evaluated for the request.

Diagnostic Logging Viewer - Now integrated as a tab into the ISA Server Management console, this feature displays detailed events on packet progress and provides information about handling and rule matching.
Improvements for existing features, including:

Support for integrated NLB mode in all three modes, including unicast, multicast, and multicast with Internet Group Management Protocol (IGMP). Previously, ISA Server integrated NLB-supported unicast mode only.

Support for use of server certificates containing multiple Subject Alternative Name (SAN) entries. Previously, ISA Server was able to use either only either the subject name (common name) of a server certificate, or the first entry in the SAN list.

Support for Kerberos Constrained Delegation cross-domain authentication. Credentials from users located in a different domain than the ISA Server, but in the same forest, can now be delegated to an internal published Web site by using KCD.

Support for client certificate authentication in a workgroup deployment. This removes the requirement to map each client certificate to an Active Directory directory user account.

For more information about this service pack, see KB 943462.