May 12, 2009

IN THIS ADVISORY:

• Hot Protections

• Microsoft Office Multiple PowerPoint Vulnerabilities
• Adobe Reader Memory Corruption Vulnerability
• MIT Kerberos Uninitialized Pointer Reference Vulnerability

• Deployment Tip

• Easing Deployment Concerns

• Highlighted Protections

• Including Patch Tuesday

DEPLOYMENT TIP
Tip: Easing Deployment Concerns
When deploying an integrated IPS, many administrators worry that they may mis-configure protections and cause unwanted traffic interruptions. To deal with this concern, the Check Point IPS Software Blade gives you the ability to create a profile that only detects malicious traffic. You can monitor the results, make any necessary adjustments, and then easily change to enforcement without having to reconfigure all of your protections. This can be useful both as an initial, or pilot deployment method and also for troubleshooting an existing installation.

To configure:

1. Set your profile as desired.
   Set the protections that you plan to use to ‘Prevent’. Once you activate ‘Detect Only’ mode, the prevention settings will be overridden and all protections will only detect and log malicious traffic.
2. Click the IPS tab and then click Profiles.
3. Double-click the profile you created in step 1.
4. Click Troubleshooting.
5. Click the button to activate Detect-Only mode and click OK.
6. Install the policy.

You can now monitor to see what the results of your policy would have been. If you find that desirable traffic is being blocked you can add exceptions and modify the configuration of individual protections from the associated logs. Once you are confident that your profile is correctly configured, you can deactivate Detect-Only mode and all the protections that are set to ‘Prevent’ will be enforced.

Have SmartDefense feature questions?
Participate in the SmartDefense User Forum. The SmartDefense Forum is your space for asking questions regarding all SmartDefense features, and to collaborate with other SmartDefense users, worldwide, on SmartDefense-related issues. Check Point employees may monitor the forum and provide information on the issues posted.

Know someone who should be getting the Advisories?

» About the Check Point Update Services
Check Point provides ongoing and real-time updates and configuration information to its R65 products through SmartDefense Services, and to Check Point R70 products through an update service included with the relevant Software Blade subscriptions. These updates increase the value of your Check Point products and minimize threats by providing defenses that can be used before vendor patches are applied throughout your network. These defenses are developed and distributed by Check Point’s global Research and Response Centers. For more information, visit www.CheckPoint.com.