Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Block MSN Messenger Live 8

Subscribe

Check Point Reference: CPAI-2006-143
Date Published:
Severity:
Last Updated:
Source: SmartDefense Research Center
Protection Provided by: VPN-1
  • NGX R62
  • NGX R61
  • NGX R60
  • NG with Application Intelligence R55W
  • NG with Application Intelligence R55
  • NG with Application Intelligence R54
VSX
  • NGX
InterSpect
  • NGX
  • 2.0 and 1.x
Connectra
  • NGX R61
Who is Vulnerable?
MSN Messenger Live 8
Vulnerability Description
Windows Live Messenger, formerly and still commonly known as MSN Messenger or MSN, is a freeware instant messaging client for Windows XP and Windows Vista. It is part of Microsoft's Windows Live set of online services.
Released on June 19, 2006, MSN Messenger Live 8 has many features including offline conversations, the possibility to share files with other users and more.
SmartDefense allows you to block MSN Messenger Live 8.
Vulnerability Details
Instant messaging applications may risk an organization's security in the following ways:

1. Vulnerabilities in IM applications could be exploited to compromise a user's system.  
2. An important capability of IM is file transfer that could be exploited by worms to infect a user's system.
3. Using voice data along with file transfers may result in excessive bandwidth utilization.

Protection Overview
The Update enables the HTTP Worm Catcher to detect and block MSN Messenger Live 8 based on pre-defined worm signatures. Please note that this update does not block MSN Messenger Live 8 Beta.

In order for the protection to be activated, update your VPN-1/InterSpect/Connectra product to the latest SmartDefense update. For information on how to update SmartDefense, go to SBP-2006-05, Protection tab and select the version of your choice.

To configure the defense, select your product from the list below and follow the related protection steps.

Additional Information
The Update released on November 30, 2006 includes the following protections:

Novell eDirectory 'evtFilteredMonitorEventsRequest' Vulnerability (CPAI-2006-137)
Microsoft NetWare Client Service Remote Code Execution Vulnerability (MS06-066) - CPAI-2006-138
Microsoft Workstation Service Buffer Overflow Vulnerability (MS06-070) - CPAI-2006-139
Microsoft XML Remote Code Execution Vulnerability (MS06-071) - CPAI-2006-140
Visual Studio WMI Code Execution Vulnerability (CPAI-2006-141)
Microsoft Agent Remote Code Execution Vulnerability (MS06-068) - CPAI-32006-142
Block MSN Messenger Live 8 (CPAI-2006-143)
AOL Nullsoft Winamp Ultravox Heap Overflow Vulnerability (CPAI-2006-144)

VPN-1 NGX R62

How Can I Protect My Network?
1. In the SmartDefense tab, click Web Intelligence > Malicious Code > General HTTP Worm Catcher.
2. In the General HTTP Worm Catcher configuration pane, under General HTTP Worm Catcher Settings > Mode, check Active.



3. Enable the following pattern:

MSN Messenger Live 8

4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: HTTP Worm Catcher
Attack Information: MSN Messenger Live 8

VPN-1 NGX R61, R60 & VPN-1 NG with Application Intelligence R55W

How Can I Protect My Network?
1. In the Web Intelligence tree, click Malicious Code > General HTTP Worm Catcher.
2. Enable the following pattern:

MSN Messenger Live 8

3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: HTTP Worm Catcher
Attack Information: MSN Messenger Live 8

VPN-1 NG with Application Intelligence R55/R54

How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > Web and enable General HTTP Worm Catcher.
2. Enable the following pattern:

MSN Messenger Live 8

3. Install security policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: HTTP Worm Catcher
Attack Information: MSN Messenger Live 8

VPN-1 VSX NGX

How Can I Protect My Network?
1. In the Web Intelligence tree, click Malicious Code > General HTTP Worm Catcher.
2. Enable the following pattern:

MSN Messenger Live 8

3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: HTTP Worm Catcher
Attack Information: MSN Messenger Live 8

InterSpect NGX

How Can I Protect My Network?
1. In the left pane, select Profiles > Default Protection and select the Web Intelligence page of the profile.
2. In the Web Intelligence tree, click Malicious Code > General HTTP Worm Catcher.
3. Enable the following pattern:

MSN Messenger Live 8

4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: HTTP Worm Catcher
Attack Information: MSN Messenger Live 8

InterSpect 2.0

How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > Web > General HTTP Worm Defender.
2. Enable the following pattern:

MSN Messenger Live 8

3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: HTTP Worm Catcher
Attack Information: MSN Messenger Live 8

Connectra NGX R61

How Can I Protect My Network?
1. In the navigation tree, click Web Intelligence. In the Malicious Code Protection pane click General HTTP Worm Catcher.
2. Enable the following pattern:

MSN Messenger Live 8

3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
Upon attack, the following entries will be logged:

Attack Name: HTTP Worm Catcher
Attack Information: MSN Messenger Live 8