SmartDefense Security Advisory: April 14, 2009

»Hot Protections

Zero-Day MS PowerPoint Parsing Code Execution Vulnerability
(Microsoft Security Advisory 969136, CVE-2009-0556)

Microsoft Office PowerPoint contains a remote code execution vulnerability. There have been some limited reports of attacks in the wild that utilize this vulnerability. No patch has been released by Microsoft, but Check Point provides protections against attacks that use this vulnerability.

MS Windows HTTP Services Credential Reflection Vulnerability
(MS09-013, CVE-2009-0550)

A remote code execution vulnerability has been disclosed in the way Microsoft Windows HTTP Services handles NTLM credentials. This vulnerability can enable a hacker to execute malicious code as a logged on user of Windows HTTP Services. Check Point provides protections against attacks that use this vulnerability.

Microsoft ISA Server TCP State Limited Denial of Service Vulnerability
(MS09-016, CVE-2009-0077)

Microsoft Internet Security and Acceleration (ISA) Server is prone to a denial of service condition. Successful exploitation will cause the Web listener to stop responding to new requests. A Check Point protection against this vulnerability has been available since 2004.

April 14, 2009

IN THIS ADVISORY:

Hot Protections

Zero-Day MS PowerPoint Parsing Code Execution Vulnerability
MS Windows HTTP Services Credential Reflection Vulnerability
Microsoft ISA Server TCP State Limited Denial of Service Vulnerability

Deployment Tip

Bypass Under Load

Highlighted Protections

Including Patch Tuesday

DEPLOYMENT TIP
Best Practice: Bypass Under Load
The new Check Point IPS Software Blade delivers not only industry-leading performance, but also tuning features to help optimize the configuration for your specific performance needs. The Bypass Under Load feature allows the administrator to temporarily suspend IPS inspection on a gateway if it comes under heavy load and resume inspection when the gateway resource use returns to acceptable levels. Load and inspection resumption thresholds are completely configurable. This means you never have to worry about your IPS causing your gateway performance to fall to unacceptable levels.

To bypass IPS inspection under heavy load in the IPS Software Blade:

In the IPS tab, select Enforcing Gateways.
Select a gateway with critical load issues and click Edit.
Select Bypass SmartDefense inspection when gateway is under heavy load. Optionally, you can select a tracking method to log activity while IPS inspection is turned off.
To configure the definition of heavy load, click Advanced.
In the High fields specify at what load threshold you want IPS inspection to be bypassed.
In the Low fields, specify when to resume IPS inspection.
Click OK.

» Highlighted Protections

This table lists Check Point protections for recently disclosed threats. In some cases, Check Point protections against such threats or threat types have been available for some time, and the date listed is the date when the protection became available.

Severity	Vulnerability Description	SmartDefense Protection Issued	Industry Reference	SmartDefense Reference Number
Critical	Internet Explorer Memory Corruption	14-Apr-09	MS09-014 CVE-2009-0554 CVE-2009-0552 CVE-2009-0551 CVE-2009-0553	CPAI-2009-084 CPAI-2009-086 CPAI-2009-078 CPAI-2009-090
Critical	Microsoft DirectShow MJPEG Decompression Remote Code Execution	14-Apr-09	MS09-011 CVE-2009-0084	CPAI-2009-080
Critical	Wordpad and Office Text Converters Remote Code Execution	14-Apr-09	MS09-010 CVE-2008-4841 CVE-2009-0235 CVE-2009-0087	CPAI-2009-074 CPAI-2009-068 CPAI-2009-072
Critical	Microsoft Windows HTTP Services Chunked Encoding Remote Code Execution	14-Apr-09	MS09-013 CVE-2009-0086	CPAI-2009-088
Critical	Microsoft Excel OBJ Record Parsing Memory Corruption	14-Apr-09	MS09-009 CVE-2009-0100	CPAI-2009-076
Critical	Microsoft Excel Rich Text Parsing Zero-Day Remote Code Execution	26-Feb-09	MS09-009 CVE-2009-0238	CPAI-2009-028
Critical	Zero-day Microsoft Office PowerPoint Invalid Object Reference	06-Apr-09	CVE-2009-0556	CPAI-2009-066
Critical	Cisco Application Networking Manager Security Bypass	22-Mar-09	CVE-2009-0616	CPAI-2009-046
Critical	IBM Tivoli Storage Manager Express Backup Server Heap Corruption	30-Mar-09	CVE-2008-4563	CPAI-2009-058
High	Microsoft Windows HTTP Services Credential Reflection Remote Code Execution	14-Apr-09	MS09-014 CVE-2009-0550	CPAI-2009-082
High	Microsoft Windows HTTP Services Certificate Name Mismatch Remote Code Execution	09-Mar-05	MS09-013 CVE-2009-0089	SBP-2009-10 CPSA-2005-002
High	Microsoft ISA Server TCP State Limited Denial of Service	21-Apr-04	MS09-016 CVE-2009-0077	SBP-2009-12 CPSA-2004-17
High	Microsoft ISA Server Cross-Site Scripting (XSS)	15-Mar-05	MS09-016 CVE-2009-0237	CPAI-2009-092 CPSA-2005-003
High	Adobe Multiple Products JBIG2 Stream Buffer Overflow	30-Mar-09	CVE-2009-0658	CPAI-2009-050
High	HP OpenView Network Node Manager Multiple Parameters Buffer Overflow	02-Apr-09	CVE-2009-0920 CVE-2009-0921	CPAI-2009-062
Medium	Microsoft Windows Searchpath Blended Threat Privilege Escalation	02-Jun-08	MS09-015 CVE-2008-2540	CPAI-2008-082

More Updates >

Have SmartDefense feature questions?
Participate in the SmartDefense User Forum. The SmartDefense Forum is your space for asking questions regarding all SmartDefense features, and to collaborate with other SmartDefense users, worldwide, on SmartDefense-related issues. Check Point employees may monitor the forum and provide information on the issues posted.

Know someone who should be getting the Advisories?

» About the Check Point Update Services
Check Point provides ongoing and real-time updates and configuration information to its R65 products through SmartDefense Services, and to Check Point R70 products through an update service included with the relevant Software Blade subscriptions. These updates increase the value of your Check Point products and minimize threats by providing defenses that can be used before vendor patches are applied throughout your network. These defenses are developed and distributed by Check Point’s global Research and Response Centers. For more information, visit www.CheckPoint.com.

Archived SmartDefense Security Advisories

You have received this notification because either you have a User Center account or you have subscribed to the SmartDefense Newsletter. If you would prefer to no longer receive security alerts and defense notifications please click the Unsubscribe link below.