SmartDefense Security Advisory: December 8, 2009

»Top Protections

Microsoft Internet Explorer HTML Object Memory Corruption Vulnerability
(CVE-2009-3672, MS09-072)

A memory corruption vulnerability has been reported in Microsoft Internet Explorer. Successful exploitation of this vulnerability will cause the browser to crash and may allow the execution of arbitrary commands. Check Point protection for enterprises is available for through its integrated IPS products, IPS Software Blade, and SmartDefense and for endpoints through the WebCheck feature of its Endpoint Security product. More information.

Microsoft Windows 7 SMB DoS
(CVE-2009-3676, MS 977544)

A denial of service vulnerability has been discovered in the way that the Microsoft Server Message Block (SMB) protocol. This vulnerability affects Windows Server 2008 and is also the first zero-day bug announced for Windows 7. Check Point provides immediate protection for this vulnerability through its IPS products, IPS Software Blade, SmartDefense, and IPS-1. More information.

Novell eDirectory Vulnerability
(Bugtraq ID: 37042)

A code execution vulnerability exists in Novell eDirectory. According to IDC, eDirectory is the most widely used directory on the market, used in 80 percent of Fortune 1000 companies. Successful exploitation would allow for execution of arbitrary code. Check Point provides protection against exploits that use this vulnerability through IPS-1. More information.

December 8, 2009

IN THIS ADVISORY:

Top Protections

Microsoft Internet Explorer HTML Object Memory Corruption Vulnerability
Microsoft Windows 7 SMB DoS
Novell eDirectory Vulnerability

Deployment Tip

Exporting Protections List

Highlighted Protections

Including Patch Tuesday

DEPLOYMENT TIP
Best Practice: Exporting Protections List
To enable administrators to analyze protections in alternative applications, you can export the Protections list as Comma Separated Value (CSV) file. The exported information includes all protections, with all table fields regardless of any applied sorting or filtering you performed on the table.

To export the protections list:

In the Protections page, click View > Export View.

In the Save As dialog box, provide a filename and click Save.

» Highlighted Protections

This table lists Check Point protections for recently disclosed threats. In some cases, Check Point protections against such threats or threat types have been available for some time, and the date listed is the date when the protection became available.

Severity	Vulnerability Description	Check Point Protection Issued	Industry Reference	Check Point Reference Number
Critical	Microsoft Internet Explorer HTML Object Memory Corruption	13-Nov-06	MS09-072 CVE-2009-3672	CPAI-2009-247 CPAI-2009-249
Critical	Microsoft Office Project Memory Validation Remote Code Execution	08-Dec-09	MS09-074 CVE-2009-0102	CPAI-2009-261
Critical	Microsoft Internet Explorer 8 Circular References Memory Corruption	08-Dec-09	MS09-072 CVE-2009-3674	CPAI-2009-267
Critical	Microsoft Internet Explorer Page Refresh Uninitialized Memory Corruption	08-Dec-09	MS09-072 CVE-2009-3673	CPAI-2009-263
Critical	Microsoft Internet Explorer 8 Overlap Components Memory Corruption	08-Dec-09	MS09-072 CVE-2009-3671	CPAI-2009-257
Critical	Novell eDirectory dhost HTTPSTK Buffer Overflow	25-Nov-09	N/A	CPAI-2009-301
Critical	HP Power Manager Remote Code Execution	19-Nov-09	CVE-2009-2685	CPAI-2009-300
Critical	Symantec Multiple Products AeXNSConsoleUtilities Buffer Overflow	30-Nov-09	CVE-2009-3031	CPAI-2009-303
High	Microsoft SMB Endless Loop Denial of Service Vulnerability	16-Nov-09	CVE-2009-3676	CPAI-2009-296
High	SSL and TLS Protocols Renegotiation Vulnerability	29-Nov-09	CVE-2009-3555	SBP-2009-23
High	Microsoft WordPad and Office Text Converter Memory Corruption	08-Dec-09	MS09-073 CVE-2009-2506	CPAI-2009-259
High	Internet Authentication Service MS-CHAP Security Bypass	08-Dec-09	MS09-071 CVE-2009-3677	CPAI-2009-253
High	Microsoft Active Directory Federation Services Code Execution Vulnerability	08-Dec-09	MS09-070 CVE-2009-2509	CPAI-2009-251
High	HP OpenView Network Node Manager Denial of Service	25-Nov-06	CVE-2009-3840	CPAI-2009-302
High	Oracle Document Capture EasyMail IMAP4 LicenseKey Buffer Overflow	30-Nov-06	N/A	CPAI-2009-305

More Updates >

Have SmartDefense feature questions?
Participate in the SmartDefense User Forum. The SmartDefense Forum is your space for asking questions regarding all SmartDefense features, and to collaborate with other SmartDefense users, worldwide, on SmartDefense-related issues. Check Point employees may monitor the forum and provide information on the issues posted.

Know someone who should be getting the Advisories?

» About the Check Point Update Services
Check Point provides ongoing and real-time updates and configuration information to its R65 products through SmartDefense Services, and to Check Point R70 products through an update service included with the relevant Software Blade subscriptions. These updates increase the value of your Check Point products and minimize threats by providing defenses that can be used before vendor patches are applied throughout your network. These defenses are developed and distributed by Check Point’s global Research and Response Centers. For more information, visit www.CheckPoint.com.

Achived Check Point Security Advisories

You have received this notification because either you have a User Center account or you have subscribed to the Check Point Security Advisory. If you would prefer to no longer receive security alerts and defense notifications please click the Unsubscribe link below.