Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Workaround for Multiple Microsoft Publisher Vulnerabilities (MS08-012)

Subscribe

Check Point Reference: SBP-2008-01
Date Published:
Severity:
Source: Microsoft Security Bulletin MS08-012
Industry Reference(s): CVE-2008-0102
CVE-2008-0104
Protection Provided by: VPN-1
  • NGX R65
  • NGX R62
  • NGX R61
  • NGX R60
  • NG with Application Intelligence R55
VSX
  • NGX
  • NGX R65
InterSpect
  • NGX
Who is Vulnerable?
Microsoft Publisher 2000 SP3
Microsoft Publisher 2002 SP3
Microsoft Publisher 2003 SP2
Vulnerability Description
Multiple vulnerabilities have been reported in Microsoft Publisher. Microsoft Publisher is a desktop publishing application for creating marketing materials, managing customer lists and more. A remote attacker can exploit these vulnerabilities via a specially crafted .pub file. Successful exploitation may allow execution of arbitrary code on a vulnerable system.
Update/Patch Available
Apply patches:
Microsoft Security Bulletin MS08-012
Vulnerability Details
The vulnerabilities are due to a memory corruption error in Microsoft Publisher that fails to properly handle malformed files. A remote attacker could trigger these flaws by convincing the victim to open a specially crafted Publisher file (.pub). Successful exploitation of these issues may allow execution of arbitrary code once the malformed file is opened on a vulnerable system.

Protection Overview
By enabling this protection, SmartDefense will detect and block the transferring of Microsoft Publisher files over HTTP. No update is required to address this vulnerability.

Users are protected against this vulnerability if the Protection against Microsoft Office Publisher Remote Code Execution addressed in CPAI-2007-087 has been applied.

To configure the defense, select your product from the list below and follow the related protection steps.

VPN-1 NGX R65 & R62

How Can I Protect My Network?
1. In the SmartDefense tab, click Application Intelligence > Content Protection.
2. Select the following:

Block Office files

3. In the configuration pane, under Settings > Mode, check Active.
4. In the configuration pane, select the following protection:

Block Publisher Documents

5. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Content Protection Violation
Attack Information: Publisher document detected (MS07-037)

VPN-1 NGX R61 & R60

How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > Content Protection.
2. Select the following:

Block Office files

3. In the configuration pane, select the following protection:

Block Publisher Documents

4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Content Protection Violation
Attack Information: Publisher document detected (MS07-037)

VPN-1 NG with Application Intelligence R55

How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > Content Protection.
2. Select the following:

Block Office files

3. In the configuration pane, select the following protection:

Block Publisher Documents

4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
Rule #980119 will appear on the SmartView Tracker.

VPN-1 VSX NGX R65

How Can I Protect My Network?
1. In the SmartDefense tab, click Application Intelligence > Content Protection.
2. Select the following:

Block Office files

3. In the configuration pane, under Settings > Mode, check Active.
4. In the configuration pane, select the following protection:

Block Publisher Documents

5. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Content Protection Violation
Attack Information: Publisher document detected (MS07-037)

VPN-1 VSX NGX

How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > Content Protection.
2. Select the following:

Block Office files

3. In the configuration pane, select the following protection:

Block Publisher Documents

4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
Rule #980119 will appear on the SmartView Tracker.

InterSpect NGX

How Can I Protect My Network?
1. In the left pane, select Profiles > Default Protection and select the SmartDefense page of the profile.
2. In the SmartDefense tree, click Application Intelligence > Content Protection.
3. Select the following protection:

Block Office files

4. In the configuration pane, select the following protections:

Block Publisher Documents

5. Install security policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Content Protection Violation
Attack Information: Publisher document detected (MS07-037)