Check Point Advisories

Microsoft SMB Endless Loop Denial of Service (CVE-2009-3676)

Vulnerability
Protection

Check Point Reference:	CPAI-2009-296
Date Published:	16 Nov 2009
Severity:	High
Last Updated:	Tuesday 19 July, 2011
Source:
Industry Reference:	CVE-2009-3676
Protection Provided by:	Security Gateway R81, R80, R77, R75, R71, R70, R65
Who is Vulnerable?
Vulnerability Description	The SMB Protocol is a network file sharing protocol. A denial of service vulnerability has been reported in the way that Microsoft Server Message Block (SMB) protocol software handles specially crafted SMB packets. The vulnerability is due to an error in the Microsoft Server Message Block (SMB) implementation that fails to sufficiently validate all fields when parsing specially crafted SMB packets. A remote attacker could exploit this flaw via a specially crafted network message. Successful exploitation could cause a denial of service condition on the target system.

Protection Overview

This protection will detect and block malformed SMB packets.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75 / R71 / R70 / R65

In the IPS tab, click Protections and find the Microsoft SMB Endless Loop Denial of Service protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: Windows SMB Protection Violation.
Attack Information: Microsoft SMB endless loop denial of service