Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Preemptive Protection against Microsoft IIS FTP Server Telnet IAC Buffer Overflow Vulnerability (MS11-004)

Subscribe

Check Point Reference: CPAI-2010-351
Date Published:
Preemptive Since:
Severity:
Last Updated:
Source: Microsoft Security Research & Defense
Microsoft Security Bulletin MS11-004
Industry Reference(s): CVE-2010-3972
Protection Provided by: Security Gateway
  • R75
  • R71
  • R70
VPN-1
  • NGX R65
VSX
  • NGX R65
IPS-1
  • IPS-1
  • IPS-1 NGX R65
Who is Vulnerable?
Microsoft Internet Information Services (IIS) 7.5
Vulnerability Description
A heap buffer overflow vulnerability has been reported within the Microsoft Internet Information Services (IIS) FTP Service. IIS is a collection of Internet services packaged with several versions of the Windows operating system. IIS includes a FTP server service for exchanging and manipulating files over a TCP computer network. A remote attacker could use this vulnerability to cause a heap-based buffer overflow and execute arbitrary code on an affected system.
Update/Patch Available
Apply patches:
Microsoft Security Bulletin MS11-004 
Vulnerability Details
The vulnerability is due to a memory corruption in the IIS FTP Service when encoding Telnet IAC characters in a FTP response. A remote unauthenticated attacker may exploit this issue by sending a crafted FTP request to a target server. Successful exploitation of this vulnerability can lead to execution of arbitrary code or a denial of service condition of FTP services.

Protection Overview
This protection will detect and block attempts to exploit this vulnerability. No update is required to address this vulnerability.

Users of Security Gateway R70/71/75 with the IPS Software Blade are automatically protected from this vulnerability if they use the Recommended Profile settings.

To configure the defense, select your product from the list below and follow the related protection steps.

Security Gateway: R75

How Can I Protect My Network?
1. In the IPS tab, click Protections > By Protocol > IPS Software Blade > Application Intelligence > FTP.
2. In the right pane, double-click the FTP Patterns protection.
3. In the Protection Details window, click on Edit. Choose the protection's Action (Override IPS Policy with: Prevent/Detect), and apply the following Additional Settings:

Limit FTP Command length to 150
Run Malicious Code Protector on FTP Commands

4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries: 

Attack Name: FTP Patterns Protection Violation
Attack Information: 
FTP command length exceeded the limit
Malicious Code Protector Suspicious ShellCode Detected 

Security Gateway: R70/R71

How Can I Protect My Network?
1. In the IPS tab, click Protections > By Protocol > Application Intelligence > FTP.
2. In the right pane, double-click the FTP Patterns protection.
3. In the Protection Details window, click on Edit. Choose the protection's Action (Override IPS Policy with: Prevent/Detect), and apply the following Additional Settings:

Limit FTP Command length to 150
Run Malicious Code Protector on FTP Commands

4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries: 

Attack Name: FTP Patterns Protection Violation
Attack Information: 
FTP command length exceeded the limit
Malicious Code Protector Suspicious ShellCode Detected 

VPN-1 NGX R65 & VSX NGX R65

How Can I Protect My Network?
1. In the SmartDefense tab, click Application Intelligence > FTP > FTP Patterns.
2. In the configuration pane, under Settings > Mode, check Active.
3. Select the following FTP Patterns protections:

Limit FTP Command length to 150
Run Malicious Code Protector on FTP Commands

4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries: 

Attack Name: FTP Patterns Protection Violation
Attack Information: 
FTP Buffer Overflow Attempt
Malicious Code Protector Suspicious ShellCode Detected 

IPS-1 & IPS-1 NGX R65

How Can I Protect My Network?
1. In the IPS-1 Policy Manager, click on the Protection tab.
2. In the Protection tree, click Application Intelligence > FTP, and select FTP Compliance protection group.
3. Click Badly placed telnet command (IPS-1 NGX R65 only)
and
FTP telnet command evasion

4. In the configuration pane, under Settings, check Active.
5. Click on Install Policy.

How Do I Know if My Network is Under Attack?
Upon attack, the following entries will be logged:

Alert Name: FTP Compliance
Description: Badly placed telnet command
                      FTP telnet command evasion