Microsoft Security Bulletins for

A man-in-the-middle attack vulnerability exists in Windows WINS servers. This vulnerability could allow a remote authenticated attacker to spoof a web proxy and thereby redirect Internet traffic to an address of the attackers choice.

• Check Point Response
• Update Protection against Microsoft WINS Server WPAD Registration Spoofing Vulnerability (MS09-008) Release Date:

A man-in-the-middle attack vulnerability exists in Windows DNS servers where dynamic update is used and ISATAP and WPAD are not already registered in DNS. This vulnerability could allow a remote authenticated attacker to spoof a web proxy thereby redirect Internet traffic to an address of the attackers choice.

• Check Point Response
• Update Protection against Microsoft DNS Server WPAD Registration Spoofing Vulnerability (MS09-008) Release Date:

A spoofing vulnerability exists in Windows DNS server. This vulnerability could allow a remote unauthenticated attacker to quickly and reliably spoof responses and insert records into the DNS servers cache, thereby redirecting Internet traffic.

• Check Point Response
• Update Protection against Multiple Microsoft DNS Server Cache Spoofing Vulnerabilities (MS09-008) Release Date:

A response validation vulnerability exists in Windows DNS Server. The vulnerability could allow an unauthenticated remote attacker to send specially crafted queries to a DNS server so as to allow greater predictability of transaction IDs used by the DNS server and thus to redirect Internet traffic from legitimate locations.

• Check Point Response
• Update Protection against Multiple Microsoft DNS Server Cache Spoofing Vulnerabilities (MS09-008) Release Date:

A spoofing vulnerability exists in the Microsoft Windows SChannel authentication component when using certificate based authentication. An attacker who successfully exploited this vulnerability would be able to authenticate to a server using only an authorized users digital certificate and without the associated private key.

• Check Point Response
• Update Protection against Microsoft Windows Security Support Provider SChannel Spoofing Vulnerability (MS09-007) Release Date:

A remote code execution vulnerability exists in the Windows kernel due to improper validation of input passed from user mode through the kernel component of GDI. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

• Check Point Response
• Update Protection against Microsoft Windows Kernel Input Validation Remote Code Execution Vulnerability (MS09-006) Release Date:

An elevation of privilege vulnerability exists in the Windows kernel due to the manner in which the kernel validates handles. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

• Check Point Response
• This is a local vulnerability that can not be mitigated by a network IPS protection.

An elevation of privilege vulnerability exists in the Windows kernel due to improper handling of a specially crafted invalid pointer. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

• Check Point Response
• This is a local vulnerability that can not be mitigated by a network IPS protection.