Preemptive Protection against WMF/EMF Vulnerabilities (MS07-017)
| Check Point Reference: | CPAI-2007-041 | |
| Date Published: | ||
| Severity: | ||
| Last Updated: | ||
| Source: | Microsoft Security Bulletin MS07-017 | |
| Industry Reference(s): | ||
| Protection Provided by: |
VPN-1
|
|
| Who is Vulnerable? Microsoft Windows 2000 SP4 Microsoft Windows XP SP2 Microsoft Windows XP Professional x64 Edition Microsoft Windows XP Professional x64 Edition SP2 Microsoft Windows Server 2003 Microsoft Windows Server 2003 SP1 Microsoft Windows Server 2003 SP2 Microsoft Windows Server 2003 (Itanium) Microsoft Windows Server 2003 with SP1 (Itanium) Microsoft Windows Server 2003 with SP2 (Itanium) Microsoft Windows Server 2003 x64 Edition Microsoft Windows Server 2003 x64 Edition SP2 Windows Vista Windows Vista x64 Edition | ||
| Vulnerability Description A remote code execution vulnerability has been discovered in the rendering of Enhanced Metafile (EMF) image format, and a denial of service vulnerability exists in the rendering of Windows Metafile (WMF) image format. WMF and EMF are image formats used in many Windows programs including Internet Explorer and Outlook. By persuading a user to open a specially crafted WMF or EMF image file, an attacker may be able to execute arbitrary code on the affected system. |
||
|
Update/Patch Available Apply patches: Microsoft Security Bulletin MS07-017 |
|
|
Vulnerability Details The vulnerability is due to an error in Microsoft Windows that fails to properly handle malformed WMF and EMF files. By convincing a user to visit a specially crafted HTML documents or open a malicious web page, a remote attacker could cause a denial of service condition or execute arbitrary code on an affected system. Successful exploitation may allow execution of arbitrary code on a vulnerable system. |
Protection Overview
By enabling this protection, SmartDefense will detect and block the transferring of WMF and EMF files over HTTP. No update is required to address this vulnerability.
Users are protected against this vulnerability if the WMF/EMF protection for blocking vulnerable files in the Protection section of CPAI-2006-020 has been applied.
To configure the defense, select your product from the list below and follow the related protection steps.
VPN-1 NGX R65 & R62
How Can I Protect My Network?
1. In the SmartDefense tab, click Application Intelligence > Content Protection.
2. Select the following:
Block WMF EMF Files
3. In the configuration pane, under Settings > Mode, check Active.
4. Install policy on all modules.
How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:
Attack Name: Content Protection Violation
Attack Information:
EMF file detected
WMF file detected
VPN-1 NGX R61, R60, VPN-1 NG with Application Intelligence R55W
How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > Content Protection.
2. Select the following:
Block WMF EMF Files
3. Install policy on all modules.
How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:
Attack Name: Content Protection Violation
Attack Information:
EMF file detected
WMF file detected
VPN-1 NG with Application Intelligence R55
How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > Content Protection.
2. Select the following:
Block WMF EMF Files
3. Install policy on all modules.
How Do I Know if My Network is Under Attack?
Rule #99879 will appear on the SmartView Tracker.
VPN-1 VSX NGX
How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > Content Protection.
2. Select the following:
Block WMF EMF Files
3. Install policy on all modules.
How Do I Know if My Network is Under Attack?
Rule #99879 will appear on the SmartView Tracker.
InterSpect NGX
How Can I Protect My Network?
1. In the left pane, select Profiles > Default Protection and select the SmartDefense page of the profile.
2. In the SmartDefense tree, click Application Intelligence > Content Protection.
3. Select the following protection:
Block WMF EMF Files
4. Install security policy on all modules.
How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:
Attack Name: Content Protection Violation
Attack Information:
EMF file detected
WMF file detected
InterSpect 2.0
How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > Content Protection.
2. Select the following pattern:
Block WMF EMF Files
3. Install security policy on all modules.
How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:
Attack Name: Content Protection Violation
Attack Information:
EMF file detected
WMF file detected