Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Update Protection against Microsoft PowerPoint RecolorInfo Atom Buffer Overrrun Vulnerability (MS11-036; CVE-2011-1270)

Subscribe

Check Point Reference: CPAI-2011-248
Date Published:
Severity:
Last Updated:
Source: Microsoft Security Bulletin MS11-036
Industry Reference(s): CVE-2011-1270
Protection Provided by: Security Gateway
  • R75
  • R71
  • R70
VPN-1
  • NGX R65
VSX
  • NGX R65
IPS-1
  • IPS-1
  • IPS-1 NGX R65
Who is Vulnerable?
Microsoft PowerPoint 2002 SP3
Microsoft PowerPoint 2003 SP3
Vulnerability Description
A remote code execution vulnerability has been identified in Microsoft PowerPoint. Microsoft PowerPoint is a popular graphics software for preparing slides and presentations. A remote attacker could exploit this issue via a malformed PowerPoint file. Successful exploitation of this vulnerability may allow execution of arbitrary code on a target system.
Update/Patch Available
Apply patches:
Microsoft Security Bulletin MS11-036
Vulnerability Details
The vulnerability is caused when Microsoft PowerPoint fails to properly handle memory during function calls while parsing a specially crafted PowerPoint file. A remote attacker could trigger this flaw by convincing a victim to open a specially crafted PowerPoint file with a malformed RecolorInfo Atom within it. Successful exploitation of this issue may allow execution of arbitrary code on a vulnerable system.

Protection Overview
This protection will detect and block the transferring of malformed PowerPoint files over HTTP. 

In order for the protection to be activated, update your Security Gateway/VPN-1 product to the latest IPS/SmartDefense update. For information on how to update IPS/SmartDefense, go to SBP-2006-05, Protection tab and select the version of your choice.

To configure the defense, select your product from the list below and follow the related protection steps.

Security Gateway: R75

How Can I Protect My Network?
1. In the IPS tab, click Protections > By Protocol > IPS Software Blade > Application Intelligence > Content Protection.
2. In the right pane, double-click the Microsoft PowerPoint RecolorInfo Atom Buffer Overrrun (MS11-036) protection.
3. In the Protection Details window, click on Edit. Choose the protection's Action (Override IPS Policy with: Prevent/Detect), and apply Additional Settings. 
4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Content Protection Violation
Attack Information: Microsoft PowerPoint RecolorInfo Atom buffer overrrun (MS11-036)

VPN-1 NGX R65 & VSX NGX R65

How Can I Protect My Network?
1. In the SmartDefense tab, click Application Intelligence > Content Protection.
2. Select the following:

Microsoft PowerPoint RecolorInfo Atom Buffer Overrrun (MS11-036)

3. In the configuration pane, under Settings > Mode, check Active.
4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Content Protection Violation
Attack Information: Microsoft PowerPoint RecolorInfo Atom buffer overrrun (MS11-036)

Security Gateway: R70/R71

How Can I Protect My Network?
1. In the IPS tab, click Protections > By Protocol > Application Intelligence > Content Protection.
2. In the right pane, double-click the Microsoft PowerPoint RecolorInfo Atom Buffer Overrrun (MS11-036) protection.
3. In the Protection Details window, click on Edit. Choose the protection's Action (Override IPS Policy with: Prevent/Detect), and apply Additional Settings. 
4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Content Protection Violation
Attack Information: Microsoft PowerPoint RecolorInfo Atom buffer overrrun (MS11-036)

IPS-1 & IPS-1 NGX R65

How Can I Protect My Network?
1. In the IPS-1 Policy Manager, click on the Protection tab.
2. In the Protection tree, click Application Intelligence > Badfiles, and select the Microsoft Office Parser protection group
3. Click Microsoft PowerPoint TextHeader Atom Memory Corruption (MS11-036) (IPS-1 NGX R65 only).
4. In the configuration pane, under Settings, check Active.
5. Click on Install Policy.

How Do I Know if My Network is Under Attack?

Upon attack, the following entries will be logged:

Alert Name: Vulnerability in MS-Office file
Description: Microsoft PowerPoint TextHeader Atom Memory Corruption (MS11-036)