Update Protection against GDI+ VML Buffer Overrun Vulnerability (MS08-052)

Vulnerability
Protection

Check Point Reference:	CPAI-2008-143
Date Published:
Severity:
Last Updated:
Source:	Microsoft Security Bulletin MS08-052
Industry Reference(s):	CVE-2007-5348
Protection Provided by:	VPN-1 NGX R65 NGX R62 NGX R61 NGX R60 VSX NGX R65 InterSpect NGX
Who is Vulnerable? Microsoft Internet Explorer 6 SP1 on Microsoft Windows 2000 SP4 Windows XP SP2 Windows XP SP3 Windows XP Professional x64 Edition Windows XP Professional x64 Edition SP2 Windows Server 2003 SP1 Windows Server 2003 SP2 Windows Server 2003 x64 Edition Windows Server 2003 x64 Edition SP2 Windows Server 2003 with SP1 (Itanium) Windows Server 2003 with SP2 (Itanium) Windows Vista Windows Vista SP1 Windows Vista x64 Edition Windows Vista x64 Edition SP1 Windows Server 2008 for 32-bit Systems Windows Server 2008 for x64-based Systems Windows Server 2008 (Itanium) Microsoft Office XP SP3 Microsoft Office 2003 SP2 2007 Microsoft Office System Microsoft Visio 2002 SP2 Microsoft Office PowerPoint Viewer 2003 Microsoft Works 8 Microsoft Digital Image Suite 2006 SQL 2000 Reporting Services SP2 on Microsoft Windows 2000 SP4 SQL Server 2005 SP2 SQL Server 2005 x64 Edition SP2 SQL Server 2005 (Itanium) SP2 Microsoft Report Viewer 2005 SP1 Redistributable Package on Microsoft Windows 2000 SP4 Microsoft Report Viewer 2008 Redistributable Package on Microsoft Windows 2000 SP4 Microsoft Forefront Client Security 1.0 on Microsoft Windows 2000 SP4
Vulnerability Description A remote code execution vulnerability has been reported in the way that GDI+ handles Vector Markup Language (VML) files. VML is a set of XML tags used for exchange, editing, and delivery of vector graphics on the web. By convincing a user to visit a specially crafted Web page, a remote attacker may trigger this vulnerability to execute arbitrary code on an affected system.

Update/Patch Available Apply patches: Microsoft Security Bulletin MS08-052
Vulnerability Details The vulnerability is due to a heap-based buffer overrun when GDI+ fails to properly process gradient sizes handled by the vector graphics link library. A remote attacker can trigger this flaw by convincing a user to view a specially crafted Web site. Successful exploitation of this vulnerability could allow execution of arbitrary code, once the malicious page is loaded.

Protection Overview
By enabling this protection, SmartDefense will detect and block attempts to exploit this vulnerability.

In order for the protection to be activated, update your VPN-1/InterSpect product to the latest SmartDefense update. For information on how to update SmartDefense, go to SBP-2006-05, Protection tab and select the version of your choice.

To configure the defense, select your product from the list below and follow the related protection steps.

VPN-1 NGX R65 & R62

How Can I Protect My Network?
1. In the SmartDefense tab, click Web Intelligence > HTTP Client Protections > Microsoft Internet Explorer Vulnerabilities > Block GDI+ VML Buffer Overrun (MS08-052).
2. In the configuration pane, under Settings > Mode, check Active.
3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Web Client Enforcement Violation
Attack Information: GDI+ VML buffer overrun (MS08-052)

VPN-1 NGX R61 & R60

How Can I Protect My Network?
1. In the Web Intelligence tree, click HTTP Client Protections > Microsoft Internet Explorer Vulnerabilities.
2. Select the following:

Block GDI+ VML Buffer Overrun (MS08-052)

3. Install security policy on all modules.

VPN-1 VSX NGX R65

InterSpect NGX

How Can I Protect My Network?
1. In the left pane, select Profiles > Default Protection and select the Web Intelligence page of the profile.
2. In the Web Intelligence tree, click HTTP Client Protections > Microsoft Internet Explorer vulnerabilities.
3. Select the following:

Block GDI+ VML Buffer Overrun (MS08-052)

4. Install security policy on all modules.

Legal Notice for Threat Center Advisories