Microsoft Corporation Information for VU#261869
Clientless SSL VPN products break web browser domain-based security models
- Vendor Information Help Date Notified: 24 Sep 2009
- Statement Date: 04 Dec 2009
- Date Updated: 07 Dec 2009
If customer chooses co-host resources of a different trust (different web applications and ssl-vpn internal application/portal) this situation can arise.
Although there is another choice that customer can make - use a separate domain for each application. The trade-off is cost vs security - using dedicated domain names, requires wild-card certificates, and multiple dns registrations. We encourage our customers to go with this solution, but as always customers have the right to choose cost of deployment over security.
While we agree with the less secure option this may pose an issue in certain deployments. With the more secure option available we feel that this is not a vulnerability in our products.
The vendor has not provided us with any further information regarding this vulnerability.
There are no additional comments at this time.