Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Preemptive Protection against Adobe Reader and Acrobat Mozilla plug-in Remote Code Execution Vulnerability (APSB09-15)

Subscribe

Check Point Reference: CPAI-2009-260
Date Published:
Preemptive Since:
Severity:
Source: Adobe Security Bulletin - APSB09-15
Industry Reference(s): CVE-2009-2991
Protection Provided by: Security Gateway
  • R70
VPN-1
  • NGX R65
VSX
  • NGX R65
Who is Vulnerable?
Adobe Reader 9.1.3 and earlier versions for Windows, Macintosh, and UNIX
Adobe Acrobat 9.1.3 and earlier versions for Windows and Macintosh
Vulnerability Description
A remote code execution vulnerability has been discovered in Adobe Reader and Acrobat. A remote attacker could implant a shell code on a target system using heap spray exploitation method. Heap spraying is a technique for exploiting vulnerabilities in internet browsers (e.g. Internet Explorer, Firefox).
Update/Patch Available
Update patches:
Adobe Security Bulletin - APSB09-15
Vulnerability Details
The vulnerability is due to the Mozilla plug-in of the Adobe Reader and Acrobat. Successful exploitation of this issue will create a denial of service condition, causing the application to become non-responsive, and may allow execution of arbitrary code on a vulnerable system.

Protection Overview
 This protection will detect and block a large number of known shell code exploits.

Users are protected against this vulnerability if the protection for blocking known shell codes in the Protection section of SBP-2006-12 has been applied.

To configure the defense, select your product from the list below and follow the related protection steps.

Security Gateway R70

How Can I Protect My Network?
1. In the IPS tab, click Protections > By Protocol > Web Intelligence > HTTP Client Protections > Microsoft Internet Explorer Vulnerabilities.
2. In the right pane, double-click the Internet Explorer Heap Spray Shell Code Execution (MS06-055 MS06-067) protection.
3. In the Protection Details window, click on Edit. Choose the protection's Action (Override IPS Policy with: Prevent/Detect), and apply Additional Settings.
4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Web Client Enforcement Violation
Attack Information: Internet Explorer Heap Spray shell code execution (MS06-055 MS06-067)

VPN-1 NGX R65

How Can I Protect My Network?
1. In the SmartDefense tab, click Web Intelligence > HTTP Client Protections > Microsoft Internet Explorer Vulnerabilities > Block Heap Spray Remote Shell Code Execution.
2. In the Block Heap Spray configuration pane, under Block Heap Spray Settings > Mode, check Active.
3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Web Client Enforcement Violation
Attack Information: Heap spray remote shell code execution

VPN-1 VSX NGX R65

How Can I Protect My Network?
1. In the SmartDefense tab, click Web Intelligence > HTTP Client Protections > Microsoft Internet Explorer Vulnerabilities > Block Heap Spray Remote Shell Code Execution.
2. In the Block Heap Spray configuration pane, under Block Heap Spray Settings > Mode, check Active.
3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Web Client Enforcement Violation
Attack Information: Heap spray remote shell code execution