Check Point SmartDefense� Services protects customers using VPN-1� NGX R65, R62, R61, R60, and VSX NGX R65 from the following Vulnerabilities:

Microsoft Exchange Server MS-TNEF Memory Corruption Vulnerability (MS09-003)

Industry Reference: CVE-2009-0098.

A remote code execution vulnerability has been reported in the way Microsoft Exchange Server decodes the Transport Neutral Encapsulation Format (TNEF) data for a message. The Microsoft Exchange Server is an implementation of an email server capable of handling numerous Internet protocol, including the Simple Mail Transfer Protocol (SMTP). TNEF is a format used by the Microsoft Exchange Server when sending messages formatted as Rich Text Format (RTF). A remote attacker may exploit this issue to execute arbitrary code on a target system. SmartDefense Services protection will detect and block the transferring of malformed RTF files over SMTP.

Protections are available immediately for this vulnerability. See CPAI-2009-010.

Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability (MS09-002)

Industry Reference: CVE-2009-0075.

A remote code execution vulnerability has been reported in Microsoft Internet Explorer. A remote attacker could exploit this issue by convincing a user to open a maliciously crafted HTML file with Internet Explorer, which will cause the browser to crash and may allow execution of arbitrary commands. SmartDefense Services protection will detect and block attempts to exploit this vulnerability.

Protections are available immediately for this vulnerability. See CPAI-2009-012.

Microsoft Exchange Server EMSMDB32 Literal Processing Vulnerability (MS09-003)

Industry Reference: CVE-2009-0099.

A denial of service vulnerability has been reported in the way the Electronic Messaging System Microsoft Data Base, 32 bit build (EMSMDB32) provider handles invalid MAPI commands. The EMSMDB32 provider refers to the Exchange Transport provider which implements both a transport and a message store provider for MAPI. It provides the ability to submit messages to Exchange Server and to read messages to an Exchange store process. A remote attacker may exploit this issue to create a denial of service condition on a target system. SmartDefense Services protection will detect and block attempts to exploit this vulnerability.

Protections are available immediately for this vulnerability. See CPAI-2009-014.

Microsoft Visual Basic Multiple ActiveX Remote Code Execution Vulnerabilities

Several remote code execution vulnerabilities have been reported in Microsoft Visual Basic. Visual Basic (VB) is an event-driven programming language that was created by Microsoft for building stand alone Windows-based programs. Developers can use it for quickly building GUI applications. A remote attacker could exploit this issue by convincing a user to visit a specially crafted HTML document or open a malicious web page. Successful exploitation could result in remote code execution on the target system once the malicious page is loaded. SmartDefense Services protection will detect and block the vulnerable ActiveX Controls.

Protections are available immediately for this vulnerability. See CPAI-2009-016.

Microsoft Internet Explorer CSS Memory Corruption Vulnerability (MS09-002)

Industry Reference: CVE-2009-0076.

A remote code execution vulnerability has been reported in the way Microsoft Internet Explorer handles Cascading Style Sheets (CSS). CSS is a formatting method for Web pages using HTML. A remote attacker could exploit this issue by convincing a user to visit a specially crafted HTML document or open a malicious web page. Successful exploitation could result in remote code execution on the target system. SmartDefense Services protection will detect and block attempts to exploit this vulnerability.

Protections are available immediately for this vulnerability. See CPAI-2009-018.

Preemptive Protection against Microsoft SQL Server sp_replwritetovarbin Limited Memory Overwrite Vulnerability (MS09-004)

Industry Reference: CVE-2008-5416.

A remote code execution vulnerability has been reported in Microsoft SQL Server. Microsoft SQL Server is a relational database management system (RDBMS). The flaw is in the way that SQL Server checks parameters in the "sp_replwritetovarbin" extended stored procedure. By sending a specially crafted SQL script to a target server, a remote attacker may trigger this vulnerability to execute arbitrary code on the affected system. SmartDefense Services protection will detect and block attempts to exploit this vulnerability. No update is required to address this vulnerability.

Protections were previously released for this vulnerability. See CPAI-2009-008.

Workaround for Microsoft Office Visio Malformed File Parsing Remote Code Execution Vulnerabilities (MS09-005)

Industry Reference: CVE-2009-0095, CVE-2009-0096, CVE-2009-0097.

Multiple remote code execution vulnerabilities have been reported in Microsoft Visio. Microsoft Visio is a diagram creation software for Microsoft Windows. A remote attacker can exploit these vulnerabilities via a specially crafted Visio file. Successful exploitation may allow execution of arbitrary code on a vulnerable system. SmartDefense Services protection will detect and block the transferring of Microsoft Visio files over HTTP. No update is required to address this vulnerability.

Protections were previously released for this vulnerability. See SBP-2009-02.

February 10, 2009

You have received this notification because you have subscribed to the SmartDefense mailing list. If you would prefer to no longer receive security alerts and defense notifications please click to Unsubscribe

As always, please feel free to contact us directly if you have any comments or questions.

Read Check Point's Privacy Policy
©2003.2009 Check Point Software Technologies Ltd. (Nasdaq: CHKP) All rights reserved.
800 Bridge Parkway, Redwood City, CA USA 94065