Check Point Advisories

Microsoft Windows Worm.Win32.Flame.A Information Collection

Vulnerability
Protection

Check Point Reference:	CPAI-2012-245
Date Published:	29 May 2012
Severity:	High
Last Updated:	Tuesday 12 June, 2012
Source:
Protection Provided by:	Security Gateway R81, R80, R77, R75, R71, R70
Who is Vulnerable?
Vulnerability Description	An information collection vulnerability has been reported in all versions of Microsoft Windows. Worm.Win32.Flame.A is a computer worm that targets Windows users. The worm propagates via removable drives and network shares. Once resident, Flame can compromise user privacy using methods such as collecting data, taking screenshots, audio and keystrokes recording and sniffing network traffic. Flame's modular design allows it's malicious functionality to be extended further.

Protection Overview

This protection will detect and block the propagation of the Flame worm.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75 / R71 / R70

In the IPS tab, click Protections and find the Microsoft Windows Worm.Win32.Flame.A Information Collection protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: Malware Traffic.
Attack Information: Microsoft Windows Worm.Win32.Flame.A Information Collection