Update Protection against Microsoft Visual Studio Crystal Reports RPT File Code Execution Vulnerability (MS07-052)
| Check Point Reference: | CPAI-2007-115 | |
| Date Published: | ||
| Severity: | ||
| Source: | Microsoft Security Bulletin MS07-052 | |
| Industry Reference(s): | CVE-2006-6133 | |
| Protection Provided by: |
VPN-1
|
|
| Who is Vulnerable? Visual Studio .NET 2002 SP1 Visual Studio .NET 2003 Visual Studio .NET 2003 SP1 Visual Studio 2005 Visual Studio 2005 SP1 | ||
| Vulnerability Description A buffer overflow vulnerability has been identified in Business Objects Crystal Reports. Crystal Reports is a software used for designing and generating reports from numerous data sources. A remote attacker could exploit this issue via a malformed RPT file. Successful exploitation of this vulnerability may allow execution of arbitrary code on a target system. |
||
|
Update/Patch Available Apply patches: Microsoft Security Bulletin MS07-052 |
|
|
Vulnerability Details The vulnerability is due to a boundary error in Crystal Reports that fails to properly handle malformed RPT files. A remote attacker could trigger this flaw by convincing a victim to open a specially crafted Crystal Reports file. Successful exploitation of this issue may allow execution of arbitrary code on a vulnerable system. |
Protection Overview
By enabling this protection, SmartDefense will detect and block the transferring of malformed Crystal Reports files (.RPT) over HTTP.
In order for the protection to be activated, update your VPN-1/InterSpect product to the latest SmartDefense update. For information on how to update SmartDefense, go to SBP-2006-05, Protection tab and select the version of your choice.
To configure the defense, select your product from the list below and follow the related protection steps.
Additional Information
The update released on October 10, 2007 includes the following protections:
Ipswitch IMail Server IMAP SEARCH Command Date String Vulnerability (CPAI-2007-111)
VMware Workstation ActiveX Control Command Execution Vulnerability (CPAI-2007-112)
Symantec Products ActiveX Control Code Execution Vulnerabilities (CPAI-2007-113)
Microsoft SQL Server Distributed Management Objects Vulnerability (CPAI-2007-114)
Microsoft Visual Studio Crystal Reports RPT File Vulnerability (MS07-052) - CPAI-2007-115
IBM and Lenovo Access Support ActiveX Control Vulnerabilities (CPAI-2007-116)
CA eTrust Intrusion Detection (caller.dll) ActiveX Control Vulnerability (CPAI-2007-117)
VPN-1 NGX R65 & R62
How Can I Protect My Network?
1. In the SmartDefense tab, click Application Intelligence > Content Protection.
2. Select the following:
Block Malformed RPT files (MS07-052)
3. In the configuration pane, under Settings > Mode, check Active.
4. Install policy on all modules.
How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:
Attack Name: Content Protection Violation
Attack Information: Malformed RPT file detected (MS07-052)
VPN-1 NGX R61 & R60
How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > Content Protection.
2. Select the following:
Block Malformed RPT files (MS07-052)
3. Install policy on all modules.
How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:
Attack Name: Content Protection Violation
Attack Information: Malformed RPT file detected (MS07-052)
VPN-1 NG with Application Intelligence R55
How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > Content Protection.
2. Select the following:
Block Malformed RPT files (MS07-052)
3. Install policy on all modules.
How Do I Know if My Network is Under Attack?
Rule #980121 will appear on the SmartView Tracker.
VPN-1 VSX NGX
How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > Content Protection.
2. Select the following:
Block Malformed RPT files (MS07-052)
3. Install policy on all modules.
How Do I Know if My Network is Under Attack?
Rule #980121 will appear on the SmartView Tracker.
InterSpect NGX
How Can I Protect My Network?
1. In the left pane, select Profiles > Default Protection and select the SmartDefense page of the profile.
2. In the SmartDefense tree, click Application Intelligence > Content Protection.
3. Select the following protection:
Block Malformed RPT files (MS07-052)
4. Install security policy on all modules.
How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:
Attack Name: Content Protection Violation
Attack Information: Malformed RPT file detected (MS07-052)