Update Protection against Microsoft Outlook Express and Windows Mail Integer Overflow Vulnerability (MS10-030)
| Check Point Reference: | CPAI-2010-076 | |
| Date Published: | ||
| Severity: | ||
| Source: | Microsoft Security Bulletin MS10-030 | |
| Industry Reference(s): | CVE-2010-0816 | |
| Protection Provided by: |
Security Gateway
|
|
| Who is Vulnerable? Microsoft Outlook Express 5.5 SP2 on Microsoft Windows 2000 SP4 Microsoft Outlook Express 6 when installed on: Windows Mail on: Windows Live Mail when installed on: | ||
| Vulnerability Description A remote code execution vulnerability has been reported in the way that Windows Mail Client handles specially crafted mail responses. Windows Mail (formerly Outlook Express) is an online communication tool for use with Windows. A remote attacker may exploit this vulnerability to take complete control of the affected system. |
||
|
Update/Patch Available Apply patches: Microsoft Security Bulletin MS10-030 |
|
|
Vulnerability Details The vulnerability is caused when a common library used by Outlook Express and Windows Mail insufficiently validates network data before using that data to calculate the necessary size of a buffer. An attacker may exploit this issue via a specially crafted POP3 or IMAP response. Successful exploitation of this vulnerability may allow the attacker to execute arbitrary code on a vulnerable system. |
Protection Overview
This protection will detect and block malformed POP3 responses.
In order for the protection to be activated, update your Security Gateway/VPN-1 product to the latest IPS/SmartDefense update. For information on how to update IPS/SmartDefense, go to SBP-2006-05, Protection tab and select the version of your choice.
To configure the defense, select your product from the list below and follow the related protection steps.