SmartDefense Security Advisory: November 10, 2009

»Top Protections

Microsoft Windows Internal Server Vulnerabilities
(MS09-064, CVE-2009-2523, MS09-066, CVE-2009-1928)

A large percentage of security breaches involve internal attacks from employees. Recently, two new, important vulnerabilities were uncovered in commonly-used Microsoft servers, making them vulnerable to such an attack. Check Point provides protection against attacks that use these vulnerabilities through its integrated IPS products, IPS Software Blade and SmartDefense. More information.

Oracle Database Server Buffer Overflow Vulnerability
(CVE-2009-1979)

A buffer overflow vulnerability exists in the Oracle Database server. A remote attacker may exploit this vulnerability to execute arbitrary code on a vulnerable system. Check Point, through its worldwide threat response team, provides immediate protection against exploits using this vulnerability through its integrated IPS offerings, IPS Software Blade and SmartDefense. More information.

Foxy
(CVE-2008-6472)

Foxy is a popular peer-to-peer file sharing application, widely used in Hong Kong, Mainland China, and Taiwan. Not only does it slow network traffic and lower employee productivity, it also can present a serious security risk. The Check Point IPS Software Blade has a variety of application controls that can be used to block applications that may violate company policy, such as this one. More information.

November 10, 2009

IN THIS ADVISORY:

Top Protections

Microsoft Windows Internal Server Vulnerabilities
Oracle Database Server Buffer Overflow Vulnerability
Foxy

Deployment Tip

Excluding Irrelevant Protection Categories

Highlighted Protections

Including Patch Tuesday

DEPLOYMENT TIP
Best Practice: Excluding Irrelevant Protection Categories
Activating protections for resources you don’t have can decrease your performance and increase false positives. With Check Point IPS Software Blade, you can avoid these issues by centrally turning off protection categories which are not relevant to your organization. For example, if you don't have Citrix server in your organization you can turn off all current and future Citrix protections.

To exclude protection categories from the IPS Policy:

In Profile Properties > IPS Policy, select Do not activate protections in the following categories and click Configure.

The Non-Auto Activation window opens.

Click Add. The Select Category window opens.
Select the categories in the tree that you do not want to be activated.
For example, if you selected to automatically activate Server Protections, and then add Syslog to the categories in the Non-Auto Activation window, the Syslog protections (such as Apply Malicious Code Protector) will not be automatically activated in this profile.

» Highlighted Protections

This table lists Check Point protections for recently disclosed threats. In some cases, Check Point protections against such threats or threat types have been available for some time, and the date listed is the date when the protection became available.

Severity	Vulnerability Description	Check Point Protection Issued	Industry Reference	Check Point Reference Number
Critical	Microsoft License Logging Server RPC Call Heap Overflow	10-Nov-09	MS09-064 CVE-2009-2523	CPAI-2009-286
Critical	Microsoft Web Services on Devices API Memory Corruption	10-Nov-09	MS09-051 CVE-2009-2512	CPAI-2009-280
Critical	Oracle Database Server Network Authentication AUTH_SESSKEY Buffer Overflow	02-Nov-08	Oracle Advisory CVE-2009-1979	CPAI-2009-274
Critical	Novell eDirectory dhost Buffer Overflow	06-Nov-09	N/A	CPAI-2009-241
Critical	NNovell NetWare NFS Portmapper RPC Module Stack Overflow	06-Nov-09	N/A	CPAI-2009-243
Critical	Adobe Reader and Acrobat Mozilla plug-in Remote Code Execution	14-Nov-06	APSB09-15 CVE-2009-2991	CPAI-2009-260
Critical	Adobe Reader U3D File Invalid Array Index Remote Code Execution	14-Oct-06	APSB09-15 CVE-2009-2990	CPAI-2009-258
Critical	Adobe BMP Image Improper Dimensions	14-Oct-09	APSB09-15 CVE-2009-2989	CPAI-2009-254
High	Microsoft Active Directory LSASS Recursive Stack Overflow	10-Nov-09	MS09-066 CVE-2009-1928	CPAI-2009-288
High	Microsoft Office Word Legacy File Remote Code Execution	10-Nov-09	MS09-068 CVE-2009-3135	CPAI-2009-276
High	Microsoft Office Excel Index Parsing Pointer Corruption	10-Nov-09	MS09-067 CVE-2009-3132	CPAI-2009-294
High	Microsoft Office Excel SXDB Record Cache Memory Corruption	10-Nov-09	MS09-067 CVE-2009-3127	CPAI-2009-292
High	Microsoft Excel Document Malformed BIFF Record Heap Overflow	10-Nov-09	MS09-067 CVE-2009-3130	CPAI-2009-282
High	Adobe Reader JPEG2000 Quantization Component Buffer Overflow	14-Oct-06	APSB09-15 CVE-2009-2994	CPAI-2009-250
High	Adobe Reader DOC.Export Methods Arbitrary File Creation	14-Oct-06	APSB09-15 CVE-2009-2993	CPAI-2009-246
High	HP LoadRunner XUpload.ocx ActiveX Control Arbitrary File Download	16-Oct-09	N/A	CPAI-2009-239
High	Application Control: Blocking Foxy	02-Nov-09	CVE-2008-6742	SBP-2009-20

More Updates >

Have SmartDefense feature questions?
Participate in the SmartDefense User Forum. The SmartDefense Forum is your space for asking questions regarding all SmartDefense features, and to collaborate with other SmartDefense users, worldwide, on SmartDefense-related issues. Check Point employees may monitor the forum and provide information on the issues posted.

Know someone who should be getting the Advisories?

» About the Check Point Update Services
Check Point provides ongoing and real-time updates and configuration information to its R65 products through SmartDefense Services, and to Check Point R70 products through an update service included with the relevant Software Blade subscriptions. These updates increase the value of your Check Point products and minimize threats by providing defenses that can be used before vendor patches are applied throughout your network. These defenses are developed and distributed by Check Point’s global Research and Response Centers. For more information, visit www.CheckPoint.com.

Achived Check Point Security Advisories

You have received this notification because either you have a User Center account or you have subscribed to the Check Point Security Advisory. If you would prefer to no longer receive security alerts and defense notifications please click the Unsubscribe link below.