Check Point Advisories

Microsoft Windows Schannel Security Package Code Execution (MS07-031; CVE-2007-2218)

Vulnerability
Protection

Check Point Reference:	CPAI-2007-283
Date Published:	27 Oct 2009
Severity:	Critical
Last Updated:	Tuesday 27 October, 2009
Source:
Industry Reference:	CVE-2007-2218
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?
Vulnerability Description	The Secure Channel (Schannel) security package supports multiple public-key-based protocols, such as SSL (Secure Sockets Layer) versions 2.0 and 3.0, Transport Layer Security (TLS) 1.0, and Private Communication Technology (PCT) 1.0. When the Schannel security package is used, DCOM automatically negotiates the best protocol, depending on the client and server capabilities. There exists a heap corruption vulnerability in the way Windows Schannel on a client machine validates server-sent digital signatures. The vulnerability is due to insufficient checks performed on server-sent digital signatures during SSL handshakes. Remote attackers can exploit this vulnerability by persuading target users to visit a specially crafted Web site. Successful exploitation would allow the attacker to execute arbitrary code on the target system with the privileges of the System level privileges. Upon an attack where code execution is unsuccessful, the affected Local Security Authentication Server, lsass.exe, will be terminated, and then the whole Windows system is required to shut down consequently. The behaviour of the host system after an attack attempt resulting in arbitrary code injection and its subsequent execution is dependent on the intention of the injected code. The injected code will be executed in the security context of the Local Security Authentication Server, which is System.

Protection Overview

This protection will detect and block attempts to exploit this vulnerability

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

In the IPS tab, click Protections and find the Microsoft Windows Schannel Security Package Code Execution (MS07-031) protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: SSL Protection Violation.
Attack Information: Microsoft Windows Schannel Security Package code execution (MS07-031)