» Hot SmartDefense Protection Reminder
While these vulnerabilities are new, SmartDefense protections already exist for many Check Point products. SmartDefense protects against broad categories of threats. Because the defenses are broader than specific attack signatures, even unknown zero-day exploits are foiled. Below are some examples of such protections.

DNS Spoofing VideoMulti-Vendor DNS Spoofing
(CVE-2008-1447) This DNS cache poisoning technique exploits DNS requests that do not randomize source ports.The spoofing vulnerability has been reported in major DNS implementations, including Microsoft Windows DNS service and Berkeley Internet Name Domain (BIND). Check Point SmartDefense protections for DNS have been available since May 2004. We strongly encourage our customers to take the necessary steps to protect their network infrastructure. For more information, see DNS Vulnerability Spoofing Protection.

Oracle BEA WebLogic Vulnerability
(CVE-2008-3257) Oracle recently announced an unpatched vulnerability in the Oracle BEA WebLogic Server Apache Connector. The vulnerability, if exploited, allows attackers to execute arbitrary code on the WebLogic Server. SmartDefense detects and blocks the overly long requests used to exploit this vulnerability. For more information, see CPAI-2008-111.

Free SmartDefense 30 Day TrialRealPlayer ActiveX Vulnerability
This buffer overflow vulnerability in the RealNetworks RealPlayer application allows an attacker to execute arbitrary code on a vulnerable system. This is due to an error in a RealPlayer ActiveX control that fails to properly handle deletion of media library files. SmartDefense detects and blocks the vulnerable ActiveX control. For more information, see CPAI-2008-109.

» Highlighted SmartDefense Updates

This table lists SmartDefense protection updates for recently disclosed threats.  In some cases, SmartDefense protections against such threats or threat types have been available for some time, and the date listed is the date when the protection became available.

Severity Vulnerability Description SmartDefense Protection
Industry Reference SmartDefense Reference
CriticalCritical Microsoft Argument Handling Memory Corruption  12-Aug-08 CVE-2008-2259
CriticalCritical Microsoft Excel Record Parsing Vulnerability 12-Aug-08 CVE-2008-3006
CriticalCritical Microsoft Internet Explorer Uninitialized Memory Corruption 12-Aug-08 CVE-2008-2256
CriticalCritical Microsoft Excel Index Array Vulnerability 12-Aug-08 CVE-2008-3005
CriticalCritical Microsoft Excel Indexing Validation Vulnerability 12-Aug-08 CVE-2008-3004
CriticalCritical Microsoft Color Management System Pathname Vulnerability 12-Aug-08 CVE-2008-2245
CriticalCritical Microsoft Office Malformed BMP Filter 12-Aug-08 CVE-2006-4841
CriticalCritical Microsoft Office PICT Filter Parsing Vulnerability 12-Aug-08 CVE-2006-5992
CriticalCritical Microsoft Office Malformed PICT Filter 12-Aug-08 CVE-2006-1307; 
CriticalCritical Microsoft Office Malformed EPS Filter 12-Aug-08 CVE-2006-1317
CriticalCritical Microsoft PowerPoint Parsing Overflow 12-Aug-08 CVE-2008-1455
CriticalCritical Oracle WebLogic Server Apache Connector HTTP Version String Buffer Vulnerability 3-Aug-08 CVE-2008-3257 CPAI-2008-111
CriticalCritical Microsoft Word Malformed Data Remote Code Execution Vulnerability (MS08-042) 17-Jul-08 CVE-2008-2244
CriticalCritical Microsoft Access Snapshot Viewer ActiveX Control Remote Code Execution 9-Jul-08 CVE-2008-2463
CriticalCritical Multiple Vendor DNS Insufficient Socket Entropy 9-Mar-05 CVE-2008-1447
US-CERT VU#800113
HighHigh Microsoft URL Parsing Cross Domain Information Disclosure 12-Aug-08 CVE-2008-1448
HighHigh Messenger Information Disclosure 12-Aug-08 CVE-2008-0082
HighHigh Aurigma and HP ActiveX Kill Bits 12-Aug-08 Microsoft Security Advisory (953839)  CPAI-2008-118
HighHigh Microsoft PowerPoint Memory Allocation vulnerabilities 12-Aug-08 CVE-2008-0120
HighHigh RealNetworks RealPlayer ActiveX Import Method Buffer Overflow 17-Apr-08 CVE-2008-3066 CPAI-2008-109
HighHigh Castle Rock Computing SNMPc Network Manager Community String Stack Vulnerability 16-Jul-06 CVE-2008-2214 CPAI-2008-106

More SmartDefense Updates >

» How to Install SmartDefense Updates
SmartDefense Updates can be downloaded and configured on your Check Point products through the Check Point SmartCenter management interface.

How to Install SmartDefense Updates

Have SmartDefense feature questions?
SmartDefense User ForumParticipate in the new SmartDefense User Forum. The SmartDefense Forum is your space for asking questions regarding all SmartDefense features. The role of this forum is to allow SmartDefense users to collaborate with other SmartDefense users, worldwide, on SmartDefense-related issues. Check Point employees may monitor the forum and provide information on the issues posted.

» About SmartDefense and SmartDefense Services
Check Point SmartDefense provides intrusion prevention capabilities that are integrated into Check Point products. SmartDefense is updated by SmartDefense Services, which provide ongoing and real-time updates and configuration advisories for defenses and security policies. SmartDefense also helps to minimize threats by providing defenses that can be used before vendor supplied patches become available or are fully installed throughout the network. SmartDefense protections are developed and distributed by SmartDefense Research and Response Centers located around the globe.

For additional information about SmartDefense and SmartDefense Services, please visit the SmartDefense section of the Check Point Website.

Archived SmartDefense Security Advisories >
August 12, 2008


» Hot SmartDefense Protection Reminder
  • Multi-Vendor DNS Spoofing
  • Oracle BEA WebLogic Vulnerability
  • RealPlayer ActiveX Vulnerability
» Highlighted SmartDefense Updates
  • Including Patch Tuesday
» How to Install SmartDefense Updates
» Deployment Tips
Tracking SmartDefense Protections by Log

Contact Us

SmartDefense User Forum

Resources for Messaging Security

SmartDefense Microsoft Security Resources

Best Practice: Tracking SmartDefense Protections by Log
You can use SmartView Tracker to find out which SmartDefense protection triggered a specific SmartDefense log entry. This information helps you analyze your protection configuration choices.

To view attack information for a log entry:
  1. Right click the log entry’s Attack or Attack Information column.
  2. Select Go to Advisory.
    The advisory opens.
  3. Click the Protection tab.
Use the information in the Protection tab to determine whether the log entry is indicative of an attack or if it is
normal traffic that you want to allow.

This tip applies to VPN-1 NGX R65.

Do you know someone who should be getting these Advisories?
Tell them to sign up using the Smart Defense Advisory Subscription page.
You have received this notification because either you have a User Center account or you have subscribed to the SmartDefense Newsletter. If you would prefer to no longer receive security alerts and defense notifications please click the Unsubscribe link below.

Read Check Point's Privacy Policy
©2003-2008 Check Point Software Technologies Ltd. (Nasdaq: CHKP) All rights reserved. 800 Bridge Parkway, Redwood City, CA USA 94065