Check Point Advisories

Microsoft Exchange Forged Meeting Request Spoofing (MS15-026; CVE-2015-1631)

Vulnerability
Protection

Check Point Reference:	CPAI-2015-0245
Date Published:	10 Mar 2015
Severity:	High
Last Updated:	Tuesday 26 May, 2015
Source:	Microsoft MS15-026
Industry Reference:	CVE-2015-1631
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?	Microsoft Exchange Server 2013 Service Pack 1 Microsoft Exchange Server 2013 Cumulative Update 7
Vulnerability Description	A spoofing vulnerability exists in Microsoft Exchange Server. The vulnerability is caused when Microsoft Exchange Server fails to properly validate meeting organizer identity when accepting or modifying meeting requests. A remote attacker can exploit this issue by sending a specially crafted meeting request.
Update/Patch Avaliable	Apply patches from: MS15-026

Protection Overview

This protection will detect and block attempts to exploit this vulnerability.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

In the IPS tab, click Protections and find the Microsoft Exchange Forged Meeting Request Spoofing (MS15-026) protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: NNTP Protection Violation.
Attack Information: Microsoft Exchange Forged Meeting Request Spoofing (MS15-026)