Microsoft Windows ISATAP IPv6 Source Address Spoofing Vulnerability (MS10-029)

Industry Reference:CVE-2010-0812.

A spoofing vulnerability has been reported in Microsoft Windows due to the way that Windows checks the inner packet's IPv6 source address in a tunneled ISATAP packet. The Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) provides IPv6 connectivity within an IPv4 Intranet. A remote attacker may exploit this vulnerability to impersonate another user or system which could allow source address filters to be bypassed. This protection will detect and block malformed IPv6 encapsulated packets where the IPv4 source address does not match the IPV6 source address.

IPS-1 & IPS-1 NGX R65: A new protection is now available.
Security Gateway R70: A new protection is now available.
VPN-1 NGX R65 & VSX NGX R65: A new protection is now available.
SBP-2010-17.

Microsoft Media Services Stack-based Buffer Overflow Vulnerability (MS10-025)

Industry Reference:CVE-2010-0478.

A buffer overflow vulnerability has been reported in Microsoft Windows Media Services. Microsoft Windows Media Services is an industrial-strength platform for streaming live or on-demand audio and video content over the Internet or an intranet. A remote attacker may exploit this vulnerability to take complete control of an affected system. This protection will detect and block attempts to exploit this vulnerability.

IPS-1 & IPS-1 NGX R65: A protection was released in a previous update.
Security Gateway R70: A protection was released in a previous update.
VPN-1 NGX R65 & VSX NGX R65: A protection was released in a previous update.
InterSpect NGX: A new protection is now available.
CPAI-2010-062.

Security Best Practice: Blocking Null Prefix in DNS MX Records

Industry Reference:CVE-2010-0024.

A denial of service vulnerability has been reported in the way that Microsoft Windows Simple Mail Transfer Protocol (SMTP) component handles specially crafted DNS Mail Exchanger (MX) resource records. The mail exchange (MX) resource record specifies a mail exchange server for a DNS domain name. A remote attacker may trigger this vulnerability via a specially crafted DNS request with a null prefix in the MX record. Successful exploitation of this issue could cause the affected system to stop accepting requests. This protection detects and blocks null prefix of DNS MX records.

IPS-1 & IPS-1 NGX R65: A protection was released in a previous update.
Security Gateway R70: A protection was released in a previous update.
VPN-1 NGX R65 & VSX NGX R65: A protection was released in a previous update.
InterSpect NGX: A new protection is now available.
SBP-2010-16.

Adobe Reader Malformed RichMedia Annotation Vulnerability (APSB10-09)

Industry Reference:CVE-2010-0197.

A memory corruption vulnerability has been reported in Adobe Reader. A remote attacker can exploit this vulnerability to execute arbitrary code on an affected system via a specially crafted PDF file. Portable Document Format (PDF) is an open file format created by Adobe Systems. It is used for representing two-dimensional documents in a device and resolution independent fixed-layout document format. Successful exploitation allows execution of arbitrary code on a vulnerable system. This protection will detect and block attempts to transfer malformed PDF files over HTTP.

IPS-1 & IPS-1 NGX R65: A new protection is now available.
Security Gateway R70: A protection was released in a previous update.
CPAI-2010-069.

SAP GUI SAPBExCommonResources ActiveX Command Execution Vulnerability

A buffer overflow vulnerability has been reported in SAP GUI, the GUI client in SAP's 3-tier architecture of database, application server and client. The vulnerability exists in the SAP GUI SAPBExCommonResources ActiveX control. The vulnerability may allow remote attackers to execute arbitrary command by convincing a target user to open a maliciously crafted HTML document. The protection will detect and block attempts to use the SAP GUI SAPBExCommonResources ActiveX control in HTML documents.

IPS-1 & IPS-1 NGX R65: A new protection is now available.
CPAI-2010-123.

Liquid XML Studio LtXmlComHelp8.dll ActiveX OpenFile Buffer Overflow Vulnerability

A vulnerability was reported in Liquid XML Studio, an XML editor developed by Liquid Technologies. The vulnerability is caused due to a boundary error in the LtXmlComHelp8.UnicodeFile.1 ActiveX control (LtXmlComHelp8.dll). This can be exploited to cause a buffer overflow via an overly long argument passed to the "OpenFile()" method. Successful exploitation may allow execution of arbitrary code. The protection will detect and block attempts to use the Liquid XML Studio ActiveX control in an HTML document.

IPS-1 & IPS-1 NGX R65: A new protection is now available.
CPAI-2010-124.

IBM Lotus Domino Web Access ActiveX Controls Buffer Overflow Vulnerability

A vulnerability has been reported in IBM Lotus Domino, a Web browser-based client platform that provides functionality similar to that of IBM Lotus Notes. The vulnerability is due to a boundary error while handling malformed data passed to the iNotes Web Access ActiveX controls. A remote attacker could exploit the vulnerability via a crafted web page. This could cause memory corruption that may lead to arbitrary code execution. The protection will detect and block attempts to use the Lotus Domino ActiveX control in HTML documents.

IPS-1 & IPS-1 NGX R65: A new protection is now available.
CPAI-2010-125.

Novell iPrint Client ienipp.ocx volatile-date-time Parsing Buffer Overflow Vulnerability

Industry Reference:CVE-2009-1569.

A buffer overflow vulnerability exists in Novell iPrint Client, an application that allows users to install and manage printers, or submit print jobs from a web browser. The vulnerability is due to a boundary error when parsing malicious 'persistence' parameter values. A remote attacker can exploit this vulnerability by persuading a target user to open a malicious web page. Successful exploitation could result in remote code execution. The protection will detect and block attempts to use specific Novell iPrint client ActiveX class-ids in HTML documents.

IPS-1 & IPS-1 NGX R65: A new protection is now available.
CPAI-2010-126.

Novell iPrint Client ienipp.ocx target-frame Stack Buffer Overflow Vulnerability

Industry Reference:CVE-2009-1568.

A buffer overflow vulnerability exists in Novell iPrint Client, an application that allows users to install and manage printers, or submit print jobs from a web browser. The vulnerability is due to a boundary error in the ActiveX control when parsing target-frame parameter values. A remote attacker can exploit this vulnerability by persuading a target user to open a malicious web page. Successful exploitation could result in remote code execution. The protection will detect and block attempts to use the Novel iPrint Active X control in HTML documents.

IPS-1 & IPS-1 NGX R65: A new protection is now available.
CPAI-2010-127.

Improvements have been made to the following protections:

Macrovision InstallShield Update Service ActiveX Control Code Execution Vulnerability
CPAI-2008-010.

Adobe Flash Player Subvert Domain Sandbox Vulnerability (APSB10-06)
CPAI-2010-039.

Microsoft Outlook Web Access Data Validation Cross-Site Scripting Vulnerability (MS08-039)
CPAI-2008-095.

Microsoft Server Service Remote Code Execution Vulnerability (MS08-067)
CPAI-2008-158.

Microsoft Media Services Stack-based Buffer Overflow Vulnerability (MS10-025)
CPAI-2010-062.

Microsoft Exchange SMTP MIME Vulnerability (MS07-026)
CPAI-2007-094.

Security Best Practice: Blocking Null Prefix in DNS MX Records
SBP-2010-16.

April 27, 2010

You have received this notification because you have subscribed to the SmartDefense mailing list. If you would prefer to no longer receive security alerts and defense notifications please click to Unsubscribe

As always, please feel free to contact us directly if you have any comments or questions.

Read Check Point's Privacy Policy
©2003.2009 Check Point Software Technologies Ltd. (Nasdaq: CHKP) All rights reserved.
800 Bridge Parkway, Redwood City, CA USA 94065