Web Proxy Service Stops Responding

When an Internet Security and Acceleration (ISA) Server-based computer that is Web publishing an SSL Web site receives an invalid SSL packet, the ISA Server Web Proxy service may crash, generate an access violation error message, and may stop providing services.

This problem may occur when all of the following conditions exist:

• SSL packets are sent to an ISA Server-based computer that is Web publishing a Web site that is configured to use SSL bridging.
• A Web Publishing rule exists and is turned on for the SSL Web site.
• An Incoming Web Requests listener exists for the SSL Web site.
• The Enable SSL listeners check box on the Incoming Web Requests tab is checked.
• On the ISA Server-based computer, a server certificate is installed and turned on. The server certificate is turned on in the Incoming Web Requests listener properties by a check mark in the Use a server certificate to authenticate to web clients check box.

You must install ISA Server Service Pack 1 (SP1) before you apply the following hotfix.

For additional information about how to obtain the latest ISA Server service pack, click the article number below to view the article in the Microsoft Knowledge Base: The following file is available for download from the Microsoft Download Center:
Release Date: May 8, 2002

For additional information about how to download Microsoft Support files, click the following article number to view the article in the Microsoft Knowledge Base: Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help to prevent any unauthorized changes to the file. To install the fix, run the self-extracting file. You do not need to restart the ISA Server computer. If the computer is part of an ISA Server array, you do not need to shut the whole array down; you can still install this fix on a one-by-one basis.

The English version of this fix should have the following file attributes or later:
This fix also applies to the French, German, Spanish, and Japanese versions of ISA Server.

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.

For additional information about another problem that this hotfix resolves, click the article number below to view the article in the Microsoft Knowledge Base: SSL bridging refers to the ability of ISA Server to encrypt or decrypt client requests, and then pass on the request to a destination Web server. For example, in a Web Publishing scenario, ISA Server can process a client SSL request by terminating the SSL connection from a client and then re-opening a new connection (either HTTP or SSL) with a Web server.

Because no listeners are configured in Incoming Web Requests by default, there is no potential for the Web Proxy service to stop responding on a default installation of ISA Server.