Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Update Protection against Microsoft Web Services on Devices API Memory Corruption Vulnerability (MS09-063)

Subscribe

Check Point Reference: CPAI-2009-280
Date Published:
Severity:
Last Updated:
Source: Microsoft Security Bulletin MS09-063
Industry Reference(s): CVE-2009-2512
Protection Provided by: Security Gateway
  • R70
VPN-1
  • NGX R65
VSX
  • NGX R65
InterSpect
  • NGX
IPS-1
  • IPS-1
  • IPS-1 NGX R65
Who is Vulnerable?
Windows Vista
Windows Vista SP1
Windows Vista SP2
Windows Vista x64 Edition
Windows Vista x64 Edition SP1
Windows Vista x64 Edition SP2
Windows Server 2008 for 32-bit Systems
Windows Server 2008 for 32-bit Systems SP2
Windows Server 2008 for x64-based Systems
Windows Server 2008 for x64-based Systems SP2
Windows Server 2008 (Itanium)
Windows Server 2008 (Itanium) SP2
Vulnerability Description
A remote code execution vulnerability has been reported in the Web Service on Devices API (WSDAPI) on Windows systems. The WSDAPI is an implementation of the Devices Profile for Web Services (DPWS) for Windows Vista and Windows Server 2008. The DPWS constrains Web Services specifications so that clients can easily discover devices. A remote attacker could exploit this issue to take complete control of an affected system.
Update/Patch Available
Apply patches:
Microsoft Security Bulletin MS09-063
Vulnerability Details
The vulnerability is due to an error in the WSDAPI process that fails to correctly validate the MIME header of a received WSDAPI message. A remote attacker can exploit this issue by sending a specially crafted MIME message to the WSD services on an affected system. Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code on a target system.

Protection Overview
This protection will detect and block specially crafted MIME messages sent to the vulnerable services.

In order for the protection to be activated, update your Security Gateway/VPN-1/InterSpect product to the latest IPS/SmartDefense update. For information on how to update IPS/SmartDefense, go to SBP-2006-05, Protection tab and select the version of your choice. 

To configure the defense, select your product from the list below and follow the related protection steps.

Security Gateway R70

How Can I Protect My Network?
1. In the IPS tab, click Protections > By Protocol > Application Intelligence > Microsoft Networks.
2. In the right pane, double-click the Microsoft Web Services on Devices API Memory Corruption (MS09-063) protection.
3. In the Protection Details window, click on Edit. Choose the protection's Action (Override IPS Policy with: Prevent/Detect), and apply Additional Settings.

Note that in order for this defense to protect your WSDAPI, you will need to configure its ports to work with the HTTP protocol. Do the following:
1. In the Services tree, right click on TCP > New TCP. The TCP Service Properties window opens.
2. Give the service a name, for example, WSDAPI. In the Port box write "5357-5358".
3. Click on Advanced. Select the Protocol Type: HTTP. Click OK twice.
4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Microsoft Protection Violation
Attack Information: Microsoft Web Services on devices API memory corruption (MS09-063)

VPN-1 NGX R65 & VPN-1 VSX NGX R65

How Can I Protect My Network?
1. In the SmartDefense tab, click Application Intelligence > Content Protection > Microsoft Web Services on Devices API Memory Corruption (MS09-063).
2. In the configuration pane, under Settings > Mode, check Active.
3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Microsoft Protection Violation
Attack Information: Microsoft Web Services on devices API memory corruption (MS09-063)

InterSpect NGX

How Can I Protect My Network?
1. In the left pane, select Profiles > Default Protection and select the SmartDefense page of the profile.
2. In the SmartDefense tree, click Application Intelligence > Microsoft Networks.
3. Select the following:

Microsoft Web Services on Devices API Memory Corruption (MS09-063)

4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Microsoft Protection Violation
Attack Information: Microsoft Web Services on devices API memory corruption (MS09-063)

IPS-1 & IPS-1 NGX R65

How Can I Protect My Network?

1. In the IPS-1 Policy Manager, click on the Protection tab.
2. In the Protection tree, click Web Intelligence > WWW 2, and select the IIS Attacks protection group.
3. Click Microsoft Web Services on Devices API Memory Corruption (MS09-063) (IPS-1 NGX R65 only).
4. In the configuration pane, under Settings, check Active.
5. Click on Install Policy.

How Do I Know if My Network is Under Attack?

Upon attack, the following entries will be logged:

Alert Name: Attacks against IIS web servers
Description: Microsoft Web Services on Devices API Memory Corruption (MS09-063)