TCP Window Size Enforcement Protection (MS09-048)

Industry References:CVE-2008-4609, CVE-2009-1925, CVE-2009-1926.

Multiple vulnerabilities exist in TCP/IP processing in Microsoft Windows. TCP/IP is a set of networking protocols that are widely used on the Internet. TCP/IP provides communications across interconnected networks of computers that have diverse hardware architectures and that run various operating systems. A remote attacker could exploit these vulnerabilities by sending specially crafted TCP/IP packets to an affected system. Successfully exploitation of these vulnerabilities could allow the attacker to take complete control of the affected system or cause the affected system to become non-responsive. This protection will detect and block attempts to exploit these TCP vulnerabilities.

IPS-1 & IPS-1 NGX R65: A new protection is now available.
Security Gateway R70: A protection was released in a previous update.
VPN-1 NGX R65 & VSX NGX R65: A protection was released in a previous update.
SBP-2009-18 .

Microsoft Remote Desktop Connection DWORD Heap Overflow Vulnerability (MS09-044)

Industry Reference:CVE-2009-1133.

A remote code execution vulnerability has been reported in the way Microsoft Remote Desktop Connection processes specific parameters returned by the RDP server. The Microsoft Remote Desktop Protocol (RDP) provides remote display and input capabilities over network connections for Microsoft Windows-based applications running on a server. A remote attacker can exploit this vulnerability by convincing a user to visit a specially crafted Web page. Successful exploitation could result in execution of arbitrary code on the affected system. This protection will detect and block malformed RDP traffic.

IPS-1 & IPS-1 NGX R65: A new protection is now available.
Security Gateway R70: A protection was released in a previous update.
VPN-1 NGX R65 & VSX NGX R65: A protection was released in a previous update.
CPAI-2009-157.

Microsoft DHTML Editing Component ActiveX Control Code Execution Vulnerability (MS09-046)

Industry Reference:CVE-2009-2519.

A remote code execution vulnerability has been reported in the DHTML Editing Component ActiveX Control. The DHTML Editing Component ActiveX control provides an HTML editor that can be used to support dynamic Web site HTML editing in software. A remote attacker can exploit this vulnerability by convincing a user to visit a specially crafted Web page. Successful exploitation could result in execution of arbitrary code on the affected system.This protection will detect and block attempts to exploit this vulnerability.

IPS-1 & IPS-1 NGX R65: A new protection is now available.
Security Gateway R70: A protection was released in a previous update.
VPN-1 NGX R65 & VSX NGX R65: A protection was released in a previous update.
CPAI-2009-127.

Microsoft Windows MP3 File Media Playback Memory Corruption Vulnerability (MS09-047)

Industry Reference:CVE-2009-2499.

A remote code execution vulnerability has been reported in the way Microsoft Windows handles specially crafted MP3 media files. MPEG-1 Audio Layer 3 (MP3) is a file format which uses lossy compression to compress audio information. A remote attacker could exploit this issue to take complete control of an affected system remotely. This protection will detect and block the transferring of malformed MP3 files over HTTP.

IPS-1 & IPS-1 NGX R65: A new protection is now available.
Security Gateway R70: A protection was released in a previous update.
VPN-1 NGX R65 & VSX NGX R65: A protection was released in a previous update.
CPAI-2009-175.

Adobe ColdFusion Server Load URL Cross-Site Scripting Vulnerability (APSB09-12)

Industry Reference:CVE-2009-1877.

A Cross Site Scripting (XSS) vulnerability has been discovered in Adobe ColdFusion server. Adobe ColdFusion is an application server for developing dynamically generated Web sites. A remote attacker could exploit this issue to execute a reflected cross-site scripting attack on web sites using the affected code. This protection will detect and block attempts to exploit this vulnerability.

Security Gateway R70: A new protection is now available.
CPAI-2009-187.

Adobe ColdFusion Server Double-Encoded Null Character Information Disclosure Vulnerability (APSB09-12)

Industry Reference:CVE-2009-1876.

An information disclosure vulnerability has been discovered in Adobe ColdFusion server. Adobe ColdFusion is an application server for developing dynamically generated Web sites. A remote attacker could exploit this issue to obtain sensitive information. This protection will detect and block attempts to exploit this vulnerability.

Security Gateway R70: A new protection is now available.
CPAI-2009-189.

Adobe Flex SDK Cross-Site Scripting Vulnerability (APSB09-13)

Industry Reference:CVE-2009-1879.

An instance of a DOM-based Cross Site Scripting (XSS) vulnerability has been discovered in Adobe Flex SDK. Adobe Flex is a software development kit released by Adobe Systems for the development and deployment of cross-platform rich Internet applications based on the Adobe Flash platform. A remote attacker could exploit this issue to execute a reflected cross-site scripting attack on web sites using the affected code.This protection will detect and block attempts to exploit this vulnerability.

Security Gateway R70: A new protection is now available.
CPAI-2009-185.

Adobe ColdFusion Server URL Parameter Manipulation Cross-Site Scripting (APSB09-12)

Industry Reference:CVE-2009-1875.

A Cross Site Scripting (XSS) vulnerability has been discovered in Adobe ColdFusion server. Adobe ColdFusion is an application server for developing dynamically generated Web sites. A remote attacker could exploit this issue to execute a cross-site scripting attack that could potentially lead to code execution.This protection will detect and block attempts to exploit this vulnerability.

Security Gateway R70: A new protection is now available.
CPAI-2009-191.

Adobe ColdFusion Server Multiple Cross-Site Scripting and Cross-Site Request Forgery Vulnerabilities (APSB09-12)

Industry Reference:CVE-2009-1872.

Multiple Cross Site Scripting (XSS) and Cross-Site Request Forgery (XSRF) vulnerabilities have been discovered in Adobe ColdFusion server. Adobe ColdFusion is an application server for developing dynamically generated Web sites. A remote attacker could exploit this issue to execute a cross-site scripting attack that could potentially lead to code execution.This protection will detect and block attempts to exploit this vulnerability.

Security Gateway R70: A new protection is now available.
CPAI-2009-193.

Adobe JRun 4 Management Console Cross-Site Scripting Vulnerability (APSB09-12)

Industry Reference:CVE-2009-1874.

A Cross Site Scripting (XSS) vulnerability has been discovered in Adobe JRun Management Console. JRun is an application server based on Java 2 Platform, Enterprise Edition (J2EE). It works with popular Web servers including Apache and IIS. A remote attacker could exploit this issue to execute a cross-site scripting attack that could potentially lead to code execution. This protection will detect and block attempts to exploit this vulnerability.

Security Gateway R70: A new protection is now available.
CPAI-2009-192.

Oracle Database REPCAT_RPC.VALIDATE_REMOTE_RC SQL Injection

Industry Reference:CVE-2009-1021.

An SQL injection vulnerability has been reported in Oracle Database server, an enterprise-level relational database application suite. Remote authenticated attackers having Create Session privileges can exploit this vulnerability to inject and execute malicious SQL commands on the target server.By enabling this protection, SmartDefense will detect and block malformed use of the REPCAT_RPC.VALIDATE_REMOTE_RC function over Oracle traffic.

Security Gateway R70: A new protection is now available.
VPN-1 NGX R65 & VSX NGX R65: A new protection is now available.
CPAI-2009-195.

September 17, 2009

You have received this notification because you have subscribed to the SmartDefense mailing list. If you would prefer to no longer receive security alerts and defense notifications please click to Unsubscribe

As always, please feel free to contact us directly if you have any comments or questions.

Read Check Point's Privacy Policy
©2003.2009 Check Point Software Technologies Ltd. (Nasdaq: CHKP) All rights reserved.
800 Bridge Parkway, Redwood City, CA USA 94065