Vulnerability in Microsoft Internet Security and Acceleration Server 2000
H.323 Filter Could Allow Remote Code Execution 
Reported by:
Thomas W Shinder M.D.
A security vulnerability exists in the H.323 filter for Microsoft Internet Security and Acceleration Server 2000 that could allow an attacker to overflow a buffer in the Microsoft Firewall Service in Microsoft Internet Security and Acceleration Server 2000. An attacker who successfully exploited this vulnerability could try to run code of their choice in the security context of the Microsoft Firewall Service. This would give the attacker complete control over the system. The H.323 filter is enabled by default on servers running ISA Server 2000 computers that are installed in integrated or firewall mode.
We recommend that all ISA Server 2000 administrators install this patch immediately. You will not need to restart the server. Only the Firewall service will require a restart.
For more information, check out the full article at: http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms04-001.asp
ISA Server 2000 Deployment Kit Survey
http://www.isaserver.org/img/upl/kitsurvey/
