Check Point Advisories

Microsoft Windows RRAS Memory Corruption (CVE-2006-2370)

Vulnerability
Protection

Check Point Reference:	CPAI-2006-251
Date Published:	18 Aug 2010
Severity:	Critical
Last Updated:	Wednesday 18 August, 2010
Source:
Industry Reference:	CVE-2006-2370
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?
Vulnerability Description	Microsoft Remote Access Connection Manager service, RASMAN, provides the functionality to remotely configure and manage various services. One such service that can be managed remotely is the Routing and Remote Access Service, RRAS. Routing and Remote Access Service makes it possible for a computer to function as a network router and access point. There exists a buffer overflow vulnerability in Microsoft Routing and Remote Access Service. The vulnerability is caused by a failure to perform proper bounds checking on a buffer prior to a copy operation. A remote attacker may leverage this vulnerability by sending a crafted request to the problematic service, which can result in the possible injection and execution of arbitrary code on the target system. In the case of an attack, where code injection is unsuccessful, the application will terminate and all existing transactions and connections will be aborted. Furthermore, the functionality of all the services that depend on the vulnerable service might be affected as well. The affected service must be started manually to resume functionality. In the case where code injection is successful, the behavior of the system will be entirely dependent on the nature of the injected code. Any code executed will be with the the security privileges of the vulnerable service, normally System.

Protection Overview

This protection will detect and block attempts to exploit this vulnerability.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

In the IPS tab, click Protections and find the Microsoft Windows RRAS Memory Corruption protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: MS-RPC Enforcement Violation.
Attack Information: Microsoft Windows RRAS memory corruption