Bangkok--17 Apr--TQPR
TippingPoint, the leader in intrusion prevention, announced that its TippingPointTM Intrusion Prevention Systems (IPS) provided preemptive, zero day protection two years prior to the discovery and disclosure of a new Microsoft Windows buffer overflow vulnerability that exists in the handling of certain malformed “Animated Cursor” files. According to the Microsoft Security Advisory KB935423, the vulnerability affects Windows 2000, XP, and 2003 as well as Vista.
In December 2004, TippingPoint released security filters through its Digital Vaccine? service to update its customers’ Intrusion Prevention Systems with protection against file format anomalies for Windows Animated Cursor, Bitmap, and Icon files. One of those filters continues to provide preemptive protection for the new zero day attack, discovered on March 28, 2007, exploiting a new Microsoft Windows Animated Cursor vulnerability. The new vulnerability is being exploited in the wild by a large number of Web sites that are hosting the exploit code. Users are compromised when they click on a link in spam messages that re-directs them to these malicious sites.
Microsoft is expected to release a patch for the vulnerability. Prior to the release of a patch, there is very little an organization can do to prevent a zero day attack. TippingPoint Intrusion Prevention Systems provide vulnerability-based protection. Because TippingPoint protects the underlying vulnerability, one security filter can protect against several different types of exploits. In addition to offering vulnerability-based protection, TippingPoint also offers protocol anomaly and statistical anomaly-based protection so that it can block or throttle malicious behavior.
“We believe TippingPoint Intrusion Prevention Systems offer far more advanced protection than any other IPS due to the skill and vulnerability expertise of our security researchers and Zero Day Initiative research network,” said Rohit Dhamankar, senior manager of security research for TippingPoint’s DVLabs. “This is yet another success story where we’ve been able to provide the most timely and accurate vulnerability protection for our customers, far in advance of an emerging threat that exploits the vulnerability. Over the last year alone, TippingPoint has provided preemptive IPS protection before a patch was available for Microsoft vulnerabilities a staggering 22 times.”
TippingPoint’s DVLabs is the premier research organization for vulnerability analysis and discovery, ensuring customers have the best preemptive protection for vulnerabilities and zero day issues. This is evidenced by the fact that TippingPoint has the largest vulnerability research team in the world, made up of over 500 Zero Day Initiative researchers, who have discovered the following vulnerabilities: http://www.zerodayinitiative.com/advisories.html ; and TippingPoint’s own internal research team, who have also made significant vulnerability discoveries: http://www.tippingpoint.com/security/published_advisories.html .
Currently, TippingPoint is working responsibly with Microsoft to address 10 non-disclosed, unpatched vulnerabilities: http://www.zerodayinitiative.com/upcoming_advisories.html .
For more information on the Microsoft vulnerability, please visit: http://www.microsoft.com/technet/security/advisory/935423.mspx .