Update Protection against Microsoft Visio Remote Code Execution Vulnerabilities (MS07-030)
| Check Point Reference: | CPAI-2007-074 | |
| Date Published: | ||
| Severity: | ||
| Source: | Microsoft Security Bulletin MS07-030 | |
| Industry Reference(s): | CVE-2007-0934 CVE-2007-0936 |
|
| Protection Provided by: |
VPN-1
|
|
| Who is Vulnerable? Microsoft Visio 2002 SP2 | ||
| Vulnerability Description Multiple remote code execution vulnerabilities have been reported in Microsoft Visio. Microsoft Visio is diagram creation software for Microsoft Windows. A remote attacker can exploit these vulnerabilities via a specially crafted Visio file. Successful exploitation may allow execution of arbitrary code on a vulnerable system. |
||
|
Update/Patch Available Apply patches: Microsoft Security Bulletin MS07-030 |
|
|
Vulnerability Details CVE-2007-0934: The vulnerability is due to an error in Microsoft Visio that fails to properly validate the version number field when processing version related data of a Visio file. CVE-2007-0936: The vulnerability is due to a memory corruption error in Microsoft Visio that fails to properly handle the parsing of a packed object. A remote attacker could trigger these flaws by convincing the victim to open a specially crafted Visio file (.VSD, VSS, or .VST). Successful exploitation of these issues allows execution of arbitrary code once a malformed Visio file is being loaded on a vulnerable system. |
Protection Overview
By enabling this protection, SmartDefense will detect and block the transferring of Microsoft Visio files over HTTP.
In order for the protection to be activated, update your VPN-1/InterSpect product to the latest SmartDefense update. For information on how to update SmartDefense, go to SBP-2006-05, Protection tab and select the version of your choice.
To configure the defense, select your product from the list below and follow the related protection steps.
Additional Information
The Update released on June 28, 2007 includes the following protections:
Microsoft Win32 API Vulnerability (MS07-035) - CPAI-2007-072
Microsoft CSS Tag Memory Corruption Vulnerability (MS07-033) - CPAI-2007-073
Microsoft Visio Vulnerabilities (MS07-030) - CPAI-2007-074
Microsoft Office MSODataSourceControl ActiveX Control Vulnerability (CPAI-2007-075)
Microsoft Speech API and Microsoft Internet Explorer Vulnerabilities (MS07-033) - CPAI-2007-076
VPN-1 NGX R65 & R62
How Can I Protect My Network?
1. In the SmartDefense tab, click Application Intelligence > Content Protection.
2. Select the following:
Block Office files
3. In the configuration pane, under Settings > Mode, check Active.
4. In the configuration pane, select the following protection:
Block Visio Documents
5. Install policy on all modules.
How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:
Attack Name: Content Protection Violation
Attack Information: Visio document detected
VPN-1 NGX R61, R60, VPN-1 NG with Application Intelligence R55W
How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > Content Protection.
2. Select the following:
Block Office files
3. In the configuration pane, select the following protection:
Block Visio Documents
4. Install policy on all modules.
How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:
Attack Name: Content Protection Violation
Attack Information: Visio document detected
VPN-1 NG with Application Intelligence R55
How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > Content Protection.
2. Select the following:
Block Office files
3. In the configuration pane, select the following protection:
Block Visio Documents
4. Install policy on all modules.
How Do I Know if My Network is Under Attack?
Rule #980119 will appear on the SmartView Tracker.
VPN-1 VSX NGX
How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > Content Protection.
2. Select the following:
Block Office files
3. In the configuration pane, select the following protection:
Block Visio Documents
4. Install policy on all modules.
How Do I Know if My Network is Under Attack?
Rule #980119 will appear on the SmartView Tracker.
InterSpect NGX
How Can I Protect My Network?
1. In the left pane, select Profiles > Default Protection and select the SmartDefense page of the profile.
2. In the SmartDefense tree, click Application Intelligence > Content Protection.
3. Select the following protection:
Block Office files
4. In the configuration pane, select the following protections:
Block Visio Documents
5. Install security policy on all modules.
How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:
Attack Name: Content Protection Violation
Attack Information: Visio document detected
InterSpect 2.0
How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > Content Protection.
2. Select the following pattern:
Block Office files
3. In the configuration pane, select the following protection:
Block Visio Documents
4. Install security policy on all modules.
How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:
Attack Name: Content Protection Violation
Attack Information: Visio document detected