Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Update Protection against Microsoft Media Services Stack-based Buffer Overflow Vulnerability (MS10-025)

Subscribe

Check Point Reference: CPAI-2010-062
Date Published:
Severity:
Last Updated:
Source: Microsoft Security Bulletin MS10-025
Industry Reference(s): CVE-2010-0478
Protection Provided by: Security Gateway
  • R75
  • R70
VPN-1
  • NGX R65
VSX
  • NGX R65
InterSpect
  • NGX
IPS-1
  • IPS-1
  • IPS-1 NGX R65
Who is Vulnerable?
Microsoft Windows 2000 Server SP4
Vulnerability Description
A buffer overflow vulnerability has been reported in Microsoft Windows Media Services. Microsoft Windows Media Services is an industrial-strength platform for streaming live or on-demand audio and video content over the Internet or an intranet. A remote attacker may exploit this vulnerability to take complete control of an affected system.
Update/Patch Available
Apply patches:
Microsoft Security Bulletin MS10-025
Vulnerability Details
This vulnerability is due to the way Windows Media Services handles transport info network packets. A remote attacker may exploit this vulnerability by sending a specially crafted transport info packet to a computer running the affected Windows Media Services. Successful exploitation may allow execution of arbitrary code on the target system.

Protection Overview
This protection will detect and block attempts to exploit this vulnerability.

In order for the protection to be activated, update your Security Gateway/VPN-1 product to the latest IPS/SmartDefense update. For information on how to update IPS/SmartDefense, go to SBP-2006-05, Protection tab and select the version of your choice.

To configure the defense, select your product from the list below and follow the related protection steps.

Security Gateway: R75

How Can I Protect My Network?
1. In the IPS tab, click Protections > By Protocol > Application Intelligence > IPS Software Blade > Content Protection.
2. In the right pane, double-click the Microsoft Media Services Stack-based Buffer Overflow (MS10-025) protection.
3. In the Protection Details window, click on Edit. Choose the protection's Action (Override IPS Policy with: Prevent/Detect), and apply Additional Settings. 
4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries: 

Attack Name: Content Protection Violation
Attack Information: Microsoft Media Services stack-based buffer overflow (MS10-025)

Security Gateway R70

How Can I Protect My Network?
1. In the IPS tab, click Protections > By Protocol > Application Intelligence > Content Protection.
2. In the right pane, double-click the Microsoft Media Services Stack-based Buffer Overflow (MS10-025) protection.
3. In the Protection Details window, click on Edit. Choose the protection's Action (Override IPS Policy with: Prevent/Detect), and apply Additional Settings.
4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Content Protection Violation
Attack Information: Microsoft Media Services stack-based buffer overflow (MS10-025)

VPN-1 NGX R65 & VPN-1 VSX NGX R65

How Can I Protect My Network?
1. In the SmartDefense tab, click Application Intelligence > Content Protection.
2. Select the following protection:

Microsoft Media Services Stack-based Buffer Overflow (MS10-025)

3. In the configuration pane, under Settings > Mode, check Active.
4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Content Protection Violation
Attack Information: Microsoft Media Services stack-based buffer overflow (MS10-025)

InterSpect NGX

How Can I Protect My Network?
1. In the left pane, select Profiles > Default Protection and select the SmartDefense page of the profile.
2. In the SmartDefense tree, click Application Intelligence > Content Protection.
3. Select the following protection:

Microsoft Media Services Stack-based Buffer Overflow (MS10-025)

4. Install security policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Content Protection Violation
Attack Information: Microsoft Media Services stack-based buffer overflow (MS10-025)

IPS-1 & IPS-1 NGX R65

How Can I Protect My Network?
1. In the IPS-1 Policy Manager, click on the Protection tab.
2. In the Protection tree, click Network Security > Microsoft Media Server (MMS) Protocol, and select the Media Services Stack-based Buffer Overflow Vulnerability (MS10-025) protection group.
3. Click Media Services Stack-based Buffer Overflow Vulnerability (MS10-025) (IPS-1 NGX R65 only).
4. In the configuration pane, under Settings, check Active.
5. Click on Install Policy.

How Do I Know if My Network is Under Attack?
Upon attack, the following entries will be logged:

Alert Name:
Description: Media Services Stack-based Buffer Overflow Vulnerability (MS10-025)