Security Best Practice: Protect Yourself from DCE-RPC Fragmented Request Evasion Technique
| Check Point Reference: | SBP-2010-34 | |
| Date Published: | ||
| Severity: | ||
| Source: | IPS Research Center | |
| Industry Reference(s): | CVE-2010-0102 | |
| Protection Provided by: |
Security Gateway
|
|
| Who is Vulnerable? Computers and networks | ||
| Vulnerability Description DCE/RPC stands for Distributed Computing Environment / Remote Procedure Calls. It is a Remote Procedure Call system that allows software to work across multiple computers, as if it were all working on the same computer. This system allows programmers to write distributed software without having to worry about the underlying network code. |
||
|
Vulnerability Details There are many known vulnerabilities in applications based on the DCE-RPC protocol. Though IDS and IPS devices have signatures to detect attacks exploiting these vulnerabilities, these devices can be evaded by using fragmented traffic. Attackers may attempt to send fragmented DCE-RPC requests as an IDS/IPS evasion technique. |
Protection Overview
This protection will detect and block fragmented DCE-RPC requests.
In order for the protection to be activated, update your Security Gateway/VPN-1 product to the latest IPS/SmartDefense update. For information on how to update IPS/SmartDefense, go to SBP-2006-05, Protection tab and select the version of your choice.
To configure the defense, select your product from the list below and follow the related protection steps.