Security Best Practice: TCP Window Size Enforcement

Industry References:CVE-2008-4609, CVE-2009-1925, CVE-2009-1926.

Multiple vulnerabilities exist in TCP/IP processing in Microsoft Windows. TCP/IP is a set of networking protocols that are widely used on the Internet. TCP/IP provides communications across interconnected networks of computers that have diverse hardware architectures and that run various operating systems. A remote attacker could exploit these vulnerabilities by sending specially crafted TCP/IP packets to an affected system. Successfully exploitation of these vulnerabilities could allow the attacker to take complete control of the affected system or cause the affected system to become non-responsive. This protection will detect and block attempts to exploit these TCP vulnerabilities.

Security Gateway R70: A new protection is now available.
VPN-1 NGX R65 & VSX NGX R65: A new protection is now available.
SBP-2009-18.

Microsoft Internet Information Services FTP Server Recursive Listing Denial of Service Vulnerability

Industry Reference:CVE-2009-2521.

A stack consumption vulnerability has been discovered in Microsoft Internet Information Services (IIS) FTP server. IIS is a collection of Internet services packaged with several versions of the Windows operating system. IIS includes a FTP server service for exchanging and manipulating files over a TCP computer network. A remote attacker could use this issue to create a denial of service condition, thus crashing the vulnerable service. This protection will detect and block attempts to exploit this vulnerability via malicious FTP patterns.

Security Gateway R70: A new protection is now available.
VPN-1 NGX R65 & VSX NGX R65: A new protection is now available.
CPAI-2009-183.

JScript Scripting Engine Web Pages Decoding Code Execution Vulnerability (MS09-045)

Industry Reference:CVE-2009-1920.

A remote code execution vulnerability has been reported in the way that the JScript scripting engine decodes script in Web pages. JScript is an interpreted, object-based scripting language that is often used to make Web sites more flexible or interactive. A remote attacker can exploit this vulnerability by convincing a user to visit a specially crafted Web page. Successful exploitation could result in execution of arbitrary code on the affected system. This protection will detect and block attempts to exploit this vulnerability.

Security Gateway R70: A new protection is now available.
VPN-1 NGX R65 & VSX NGX R65: Preemptive protection is provided by this product.
CPAI-2009-181.

Microsoft DHTML Editing Component ActiveX Control Code Execution Vulnerability (MS09-046)

Industry Reference:CVE-2009-2519.

A remote code execution vulnerability has been reported in the DHTML Editing Component ActiveX Control. The DHTML Editing Component ActiveX control provides an HTML editor that can be used to support dynamic Web site HTML editing in software. A remote attacker can exploit this vulnerability by convincing a user to visit a specially crafted Web page. Successful exploitation could result in execution of arbitrary code on the affected system. This protection will detect and block attempts to exploit this vulnerability.

Security Gateway R70: A new protection is now available.
VPN-1 NGX R65 & VSX NGX R65: A new protection is now available.
CPAI-2009-127.

Microsoft Windows ASF File Media Header Parsing Remote Code Execution Vulnerability (MS09-047)

Industry Reference:CVE-2009-2498.

A remote code execution vulnerability has been reported in the way Microsoft Windows handles specially crafted ASF format files. ASF (Advanced Systems Format) is a file format that stores audio and video information and is specially designed to run over networks like the Internet. It is a compressed format that contains streaming audio, video, slide shows, and synchronized events. ASF enables content to be delivered as a continuous flow of data. ASF files may have the file extensions ASF, WMV, or WMA. A remote attacker could exploit this issue to take complete control of an affected system remotely. This protection will detect and block the transferring of malformed ASF files over HTTP.

Security Gateway R70: A new protection is now available.
VPN-1 NGX R65 & VSX NGX R65: A new protection is now available.
CPAI-2009-173.

Microsoft Windows MP3 File Media Playback Memory Corruption Vulnerability (MS09-047)

Industry Reference:CVE-2009-2499.

A remote code execution vulnerability has been reported in the way Microsoft Windows handles specially crafted MP3 media files. MPEG-1 Audio Layer 3 (MP3) is a file format which uses lossy compression to compress audio information. A remote attacker could exploit this issue to take complete control of an affected system remotely. This protection will detect and block the transferring of malformed MP3 files over HTTP.

Security Gateway R70: A new protection is now available.
VPN-1 NGX R65 & VSX NGX R65: A new protection is now available.
CPAI-2009-175.

Microsoft Active Template Library (ATL) Multiple ActiveX Remote Code Execution Vulnerabilities (MS09-037)

Industry References:CVE-2008-0020, CVE-2009-2494.

Multiple remote code execution vulnerabilities have been reported in the Microsoft ATL. The Active Template Library (ATL) is a set of template-based C++ classes that simplify the programming of Component Object Model (COM) objects. A remote attacker can exploit these vulnerabilities by convincing a user to visit a specially crafted Web page. Successful exploitation could result in execution of arbitrary code on the affected system. This protection will detect and block attempts to exploit this vulnerability.

Security Gateway R70: A new protection is now available.
VPN-1 NGX R65 & VSX NGX R65: A new protection is now available.
CPAI-2009-179.

September 8, 2009

You have received this notification because you have subscribed to the SmartDefense mailing list. If you would prefer to no longer receive security alerts and defense notifications please click to Unsubscribe

As always, please feel free to contact us directly if you have any comments or questions.

Read Check Point's Privacy Policy
©2003.2009 Check Point Software Technologies Ltd. (Nasdaq: CHKP) All rights reserved.
800 Bridge Parkway, Redwood City, CA USA 94065