SmartDefense Security Alert: August 12, 2008

» Hot SmartDefense Protection Reminder
While these vulnerabilities are new, SmartDefense protections already exist for many Check Point products. SmartDefense protects against broad categories of threats. Because the defenses are broader than specific attack signatures, even unknown zero-day exploits are foiled. Below are some examples of such protections.

Multi-Vendor DNS Spoofing
(CVE-2008-1447) This DNS cache poisoning technique exploits DNS requests that do not randomize source ports.The spoofing vulnerability has been reported in major DNS implementations, including Microsoft Windows DNS service and Berkeley Internet Name Domain (BIND). Check Point SmartDefense protections for DNS have been available since May 2004. We strongly encourage our customers to take the necessary steps to protect their network infrastructure. For more information, see DNS Vulnerability Spoofing Protection.

Oracle BEA WebLogic Vulnerability
(CVE-2008-3257) Oracle recently announced an unpatched vulnerability in the Oracle BEA WebLogic Server Apache Connector. The vulnerability, if exploited, allows attackers to execute arbitrary code on the WebLogic Server. SmartDefense detects and blocks the overly long requests used to exploit this vulnerability. For more information, see CPAI-2008-111.

RealPlayer ActiveX Vulnerability
This buffer overflow vulnerability in the RealNetworks RealPlayer application allows an attacker to execute arbitrary code on a vulnerable system. This is due to an error in a RealPlayer ActiveX control that fails to properly handle deletion of media library files. SmartDefense detects and blocks the vulnerable ActiveX control. For more information, see CPAI-2008-109.

» Highlighted SmartDefense Updates

This table lists SmartDefense protection updates for recently disclosed threats. In some cases, SmartDefense protections against such threats or threat types have been available for some time, and the date listed is the date when the protection became available.

Severity	Vulnerability Description	SmartDefense Protection Issued	Industry Reference	SmartDefense Reference Number
Critical	Microsoft Argument Handling Memory Corruption	12-Aug-08	CVE-2008-2259 MS08-045	CPAI-2008-125
Critical	Microsoft Excel Record Parsing Vulnerability	12-Aug-08	CVE-2008-3006 MS08-043	CPAI-2008-124
Critical	Microsoft Internet Explorer Uninitialized Memory Corruption	12-Aug-08	CVE-2008-2256 MS08-045	CPAI-2008-119
Critical	Microsoft Excel Index Array Vulnerability	12-Aug-08	CVE-2008-3005 MS08-043	CPAI-2008-123
Critical	Microsoft Excel Indexing Validation Vulnerability	12-Aug-08	CVE-2008-3004 MS08-043	CPAI-2008-122
Critical	Microsoft Color Management System Pathname Vulnerability	12-Aug-08	CVE-2008-2245 MS08-046	CPAI-2008-121
Critical	Microsoft Office Malformed BMP Filter	12-Aug-08	CVE-2006-4841 MS08-044	CPAI-2008-116
Critical	Microsoft Office PICT Filter Parsing Vulnerability	12-Aug-08	CVE-2006-5992 MS08-044	CPAI-2008-115
Critical	Microsoft Office Malformed PICT Filter	12-Aug-08	CVE-2006-1307; MS08-044	CPAI-2008-114
Critical	Microsoft Office Malformed EPS Filter	12-Aug-08	CVE-2006-1317 MS08-044	SBP-2008-09
Critical	Microsoft PowerPoint Parsing Overflow	12-Aug-08	CVE-2008-1455 MS08-051	CPAI-2008-113
Critical	Oracle WebLogic Server Apache Connector HTTP Version String Buffer Vulnerability	3-Aug-08	CVE-2008-3257	CPAI-2008-111
Critical	Microsoft Word Malformed Data Remote Code Execution Vulnerability (MS08-042)	17-Jul-08	CVE-2008-2244 MS08-042	CPAI-2008-097
Critical	Microsoft Access Snapshot Viewer ActiveX Control Remote Code Execution	9-Jul-08	CVE-2008-2463 MS08-041	CPAI-2008-096
Critical	Multiple Vendor DNS Insufficient Socket Entropy	9-Mar-05	CVE-2008-1447 US-CERT VU#800113	CPAI-2008-092
High	Microsoft URL Parsing Cross Domain Information Disclosure	12-Aug-08	CVE-2008-1448 MS08-048	CPAI-2008-126
High	Messenger Information Disclosure	12-Aug-08	CVE-2008-0082 MS08-050	CPAI-2008-120
High	Aurigma and HP ActiveX Kill Bits	12-Aug-08	Microsoft Security Advisory (953839)	CPAI-2008-118
High	Microsoft PowerPoint Memory Allocation vulnerabilities	12-Aug-08	CVE-2008-0120 CVE-2008-0121 MS08-051	CPAI-2008-117
High	RealNetworks RealPlayer ActiveX Import Method Buffer Overflow	17-Apr-08	CVE-2008-3066	CPAI-2008-109
High	Castle Rock Computing SNMPc Network Manager Community String Stack Vulnerability	16-Jul-06	CVE-2008-2214	CPAI-2008-106

More SmartDefense Updates >

» How to Install SmartDefense Updates
SmartDefense Updates can be downloaded and configured on your Check Point products through the Check Point SmartCenter management interface.

Have SmartDefense feature questions?

Participate in the new SmartDefense User Forum. The SmartDefense Forum is your space for asking questions regarding all SmartDefense features. The role of this forum is to allow SmartDefense users to collaborate with other SmartDefense users, worldwide, on SmartDefense-related issues. Check Point employees may monitor the forum and provide information on the issues posted.

» About SmartDefense and SmartDefense Services
Check Point SmartDefense provides intrusion prevention capabilities that are integrated into Check Point products. SmartDefense is updated by SmartDefense Services, which provide ongoing and real-time updates and configuration advisories for defenses and security policies. SmartDefense also helps to minimize threats by providing defenses that can be used before vendor supplied patches become available or are fully installed throughout the network. SmartDefense protections are developed and distributed by SmartDefense Research and Response Centers located around the globe.

For additional information about SmartDefense and SmartDefense Services, please visit the SmartDefense section of the Check Point Website.

Archived SmartDefense Security Advisories >

August 12, 2008

IN THIS ADVISORY:

» Hot SmartDefense Protection Reminder

Multi-Vendor DNS Spoofing
Oracle BEA WebLogic Vulnerability
RealPlayer ActiveX Vulnerability

» Highlighted SmartDefense Updates

Including Patch Tuesday

» How to Install SmartDefense Updates
» Deployment Tips

Tracking SmartDefense Protections by Log

SMARTDEFENSE DEPLOYMENT TIPS
Best Practice: Tracking SmartDefense Protections by Log
You can use SmartView Tracker to find out which SmartDefense protection triggered a specific SmartDefense log entry. This information helps you analyze your protection configuration choices.

To view attack information for a log entry:

Right click the log entry’s Attack or Attack Information column.
Select Go to Advisory.
The advisory opens.
Click the Protection tab.

Use the information in the Protection tab to determine whether the log entry is indicative of an attack or if it is
normal traffic that you want to allow.

This tip applies to VPN-1 NGX R65.

Do you know someone who should be getting these Advisories?
Tell them to sign up using the Smart Defense Advisory Subscription page.

You have received this notification because either you have a User Center account or you have subscribed to the SmartDefense Newsletter. If you would prefer to no longer receive security alerts and defense notifications please click the Unsubscribe link below.