A zero-day attack or threat is an attack that exploits a previously unknown vulnerability in a computer application, operation system etc. Multiple zero-day vulnerabilities can be found each year. The following are the well-known zero-day vulnerabilities for the first half year of 2012. Dell SonicWALL coverage for these vulnerabilities and references are also listed:

• CVE-2012-0779 Adobe Flash Player vulnerability
  * Covered by signature: [GAV:CVE-2012-0779.dc],[GAV:Malformed.swf.MP.6],[IPS:6231],[IPS:6511],[IPS:7610],[IPS:7772],[IPS:8068]
• CVE-2012-0152 (Microsoft Windows Remote Desktop Server Denial of Service)
  Covered by Firewall synflood protection feature “Always proxy WAN client connections”.
• CVE-2012-1675 Oracle TNS Poison vulnerability
  Covered by signature: [IPS:7757] REF: Oracle TNS Poison vulnerability
• CVE-2012-1875 Microsoft IE Same ID Property Remote Code Execution Vulnerability
  Covered by signature:[IPS:7454],[IPS:7963],[IPS:7998] REF: Cumulative Security Update for Internet Explorer (2699988)
• CVE-2012-1889 MSXML Uninitialized Memory Corruption Vulnerability
  Covered by signature: [IPS:7967], [IPS:7968], [IPS:7969], [IPS:7970], [IPS:7971] REF: Microsoft Security Bulletin Coverage (Jun 12, 2012)

With the deployed signatures, Dell SonicWALL has prevented the customers from being attacked. The following are the statistics within last 20 days:

To better protect our customers, Dell SonicWALL has partnered with Microsoft on the MAPP program, and here is the MAPP landing page: https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=380.

In the above page, you can find all the Microsoft released vulnerabilities and our coverage for the past two years. Dell SonicWALL has been successfully cooperated with Microsoft for the vulnerabilities detecting and preventing, for example, the latest 0day vulnerability CVE-2012-1889, we have deployed the signatures at the same day when Microsoft released the public advisory: MAPP Partners with Updated Protections

In addition to the signatures of detecting 0day vulnerabilities, we have more than 200 shellcode detection IPS signatures, which proactively detects and blocks many attacks in the wild. The following are some examples of the IPS signatures:

• 4569 HTTP Server Shellcode Exploit 8
• 4573 Server Application Shellcode Exploit 10
• 4574 HTTP Server Shellcode Exploit 10
• 4584 Server Application Shellcode Exploit 17
• 4598 Server Application Shellcode Exploit 3
• 4601 HTTP Server Shellcode Exploit 11

Microsoft XML Core Services (MSXML) is a set of services that allow building Windows-native XML-based applications. All MSXML products are exposed as Component Object Model (COM) objects. Each version of MSXML exposes its own set of CLSIDs and ProgIDs.

A memory corruption vulnerability exists in Microsoft XML Core Services. Specifically, the vulnerable MSXML objects fail to handle parameter exceptions when certain method is invocated. A remote attacker can exploit this vulnerability by enticing a user to open a specially crafted web page. Successful exploitation could result in arbitrary code execution in the context of the currently logged-in user. Failed attacks will cause denial-of-service conditions.

The vulnerability has been assigned as CVE-2012-1889.

SonicWALL has released multiple IPS signatures to detect and block specific exploitation attempts targeting this vulnerability. The signatures are listed below:

• 7967 Microsoft XML Core Services Uninitialized Object Access 1

• 7968 Microsoft XML Core Services Uninitialized Object Access 2

• 7969 Microsoft XML Core Services Uninitialized Object Access 3

• 7970 Microsoft XML Core Services Uninitialized Object Access 4

• 7971 Microsoft XML Core Services Uninitialized Object Access 5

• 8007 Microsoft XML Core Services Uninitialized Object Access 6

• 8008 Microsoft XML Core Services Uninitialized Object Access 7

• 8009 Microsoft XML Core Services Uninitialized Object Access 8

• 8010 Microsoft XML Core Services Uninitialized Object Access 9

• 8011 Microsoft XML Core Services Uninitialized Object Access 10

• 8012 Microsoft XML Core Services Uninitialized Object Access 11

• 8013 Microsoft XML Core Services Uninitialized Object Access 12