Microsoft Corporation Information for VU#261869

Clientless SSL VPN products break web browser domain-based security models

Status

Affected

Vendor Statement

If customer chooses co-host resources of a different trust (different web applications and ssl-vpn internal application/portal) this situation can arise.

Although there is another choice that customer can make - use a separate domain for each application. The trade-off is cost vs security - using dedicated domain names, requires wild-card certificates, and multiple dns registrations. We encourage our customers to go with this solution, but as always customers have the right to choose cost of deployment over security.

While we agree with the less secure option this may pose an issue in certain deployments. With the more secure option available we feel that this is not a vulnerability in our products.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Vendor References

None

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.