Incorrect Canonicalization in Rules Engine

Some specific URLs are not blocked by the Rules engine even when they are denied by a Site and Content rule. If a Site and Content rule exists that denies access to a specific destination such as www.example.com, a user can still visit that site if they type the destination in the following format: Note the period at the end of the domain name (also known as the "root" in DNS terms).

This problem may occur because of incorrect canonicalization. The Internet Security and Acceleration (ISA) Server rules engine does not match a requested domain name that specifies the root (.) unless the domain in the Destination Set also contains the root (.).

You must install ISA Server Service Pack 1 (SP1) before you apply the following hotfix.

For additional information about how to obtain the latest ISA Server service pack, click the article number below to view the article in the Microsoft Knowledge Base: The following file is available for download from the Microsoft Download Center:
Release Date: May 8, 2002

For additional information about how to download Microsoft Support files, click the following article number to view the article in the Microsoft Knowledge Base: Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help to prevent any unauthorized changes to the file. To install the fix, run the self-extracting file. You do not have to restart the ISA Server computer. If the computer is part of an ISA Server array, you do not have to shut the whole array down; you can still install this fix on a one-by-one basis.

The English version of this fix should have the following file attributes or later:
NOTE: This fix also applies to the French, German, Spanish, and Japanese versions of ISA Server.

To work around this problem without the hotfix and block requests that specify the root such as you must add a destination for www.example.com. in the corresponding Destination set.

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.

For additional information about another problem that this hotfix resolves, click the article number below to view the article in the Microsoft Knowledge Base: