Workaround for Microsoft Malware Protection Engine Denial of Service Vulnerability (MS08-029)
| Check Point Reference: | SBP-2008-06 | |
| Date Published: | ||
| Severity: | ||
| Last Updated: | ||
| Source: | Microsoft Security Bulletin MS08-029 | |
| Industry Reference(s): | CVE-2008-1437 | |
| Protection Provided by: |
VPN-1
|
|
| Who is Vulnerable? Windows Live OneCare Microsoft Antigen for Exchange 9.x Microsoft Antigen for SMTP Gateway 9.x Microsoft Windows Defender for Windows XP Microsoft Windows Defender in Windows Vista Microsoft Forefront Client Security Microsoft Forefront Edge Server Microsoft Forefront Security for Exchange Server Microsoft Forefront Security for SharePoint Standalone System Sweeper with MDOP | ||
| Vulnerability Description A denial of service vulnerability has been reported in Microsoft Malware Protection Engine. The Microsoft Malware Protection Engine provides the scanning, detection and cleaning capabilities for the following antivirus and antispyware clients: Windows Live OneCare, Microsoft Forefront Security, Microsoft Antigen, and Windows Defender. A remote attacker can exploit this issue via a specially crafted file. Successful exploitation of this vulnerability may lead to a denial of service condition, causing the computer to stop responding and automatically restart. |
||
|
Update/Patch Available Apply patches: Microsoft Security Bulletin MS08-029 |
|
|
Vulnerability Details The vulnerability is due to an error in the Microsoft Malware Protection Engine that fails to properly validate input while parsing specially crafted files. A remote attacker could trigger this flaw by convincing a victim to open a specially crafted file that allows a denial of service when the target Microsoft Malware Protection Engine scans it. Successful exploitation of this issue may cause the affected system to create large temporary files, creating a denial of service condition by filling up the systems disk space. |
Protection Overview
By enabling this protection, SmartDefense will detect and block Windows executable (PE) files.
Since the protection offered in this advisory may degrade performance and block access to legitimate files, users are advised to use this protection as a workaround till all systems are patched.
In order for the protection to be activated, update your VPN-1 product to the latest SmartDefense update. For information on how to update SmartDefense, go to SBP-2006-05, Protection tab and select the version of your choice.
To configure the defense, select your product from the list below and follow the related protection steps.