Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Preemptive Protection against Microsoft Internet Information Services FTP Server Remote Buffer Overflow Vulnerability (MS09-053)

Subscribe

Check Point Reference: CPAI-2009-153
Date Published:
Preemptive Since:
Severity:
Last Updated:
Source: Microsoft Security Advisory (975191)
Microsoft Security Bulletin MS09-053
Industry Reference(s): CVE-2009-3023
Protection Provided by: Security Gateway
  • R70
VPN-1
  • NGX R65
VSX
  • NGX R65
IPS-1
  • IPS-1
  • IPS-1 NGX R65
Who is Vulnerable?
Microsoft Internet Information Services 5.x
Microsoft Internet Information Services 6.0
Vulnerability Description
A remote code execution vulnerability has been discovered in Microsoft Internet Information Services (IIS). IIS is a collection of Internet services packaged with several versions of the Windows operating system. IIS includes a FTP server service for exchanging and manipulating files over a TCP computer network. A remote attacker with write access in the FTP service could use this vulnerability to cause a stack-based overrun and execute arbitrary code in the context of the local system.
Update/Patch Available
Apply patches:
Microsoft Security Bulletin MS09-053
Vulnerability Details
The vulnerability is due to an error in IIS that fails to do sufficient bounds checking when processing an FTP NLST command. A remote attacker may exploit this issue by crafting an FTP session. Successful exploitation of this vulnerability would allow the attacker to take complete control of the affected system.

Protection Overview
This protection will detect and block attempts to exploit this vulnerability. No update is required to address this vulnerability.

Users of Security Gateway R70 with the IPS Software Blade are automatically protected from this vulnerability if they use the Recommended Profile settings.

To configure the defense, select your product from the list below and follow the related protection steps.

Security Gateway R70

How Can I Protect My Network?
1. In the IPS tab, click Protections > By Protocol > Application Intelligence > FTP.
2. In the right pane, double-click the FTP Patterns protection.
3. In the Protection Details window, click on Edit. Choose the protection's Action (Override IPS Policy with: Prevent/Detect), and apply the following Additional Settings:

Limit FTP Command length to 150
Run Malicious Code Protector on FTP Commands

4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: FTP Patterns Protection Violation
Attack Information:
SITE command length exceeded the limit. Potential buffer overflow
Malicious Code Protector Suspicious ShellCode Detected

VPN-1 NGX R65

How Can I Protect My Network?
1. In the SmartDefense tab, click Application Intelligence > FTP > FTP Patterns.
2. In the configuration pane, under Settings > Mode, check Active.
3. Select the following FTP Patterns protections:

Limit FTP Command length to 150
Run Malicious Code Protector on FTP Commands

4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: FTP Patterns Protection Violation
Attack Information:
SITE Buffer Overflow Attempt
Malicious Code Protector Suspicious ShellCode Detected

VPN-1 VSX NGX R65

How Can I Protect My Network?
1. In the SmartDefense tab, click Application Intelligence > FTP > FTP Patterns.
2. In the configuration pane, under Settings > Mode, check Active.
3. Select the following FTP Patterns protections:

Limit FTP Command length to 150
Run Malicious Code Protector on FTP Commands

4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: FTP Patterns Protection Violation
Attack Information:
SITE Buffer Overflow Attempt
Malicious Code Protector Suspicious ShellCode Detected

IPS-1 & IPS-1 NGX R65

How Can I Protect My Network?

1. In the IPS-1 Policy Manager, click on the Protection tab.
2. In the Protection tree, click Application Intelligence > FTP, and select the FTP Command Attacks protection group.
3. Click Long FTP pathname (IPS-1 NGX R65 only).
4. In the configuration pane, under Settings, check Active.
5. Click on Install Policy.

How Do I Know if My Network is Under Attack?

Upon attack, the following entry will be logged:

Alert Name: FTP Commands
Description: Long FTP pathname