topic Microsoft Windows SChannel Malformed Certificate Request Remote Code Execution in General Topics

Microsoft Windows SChannel Malformed Certificate Request Remote Code Execution

MLaden — Wed, 28 Aug 2013 22:10:51 GMT

Hi.

Can anyone provide insight into the threat signature for MS10-049? What it triggers on, etc.? I have seen this triggered by Goggle domain IP sources that produce certificate errors.

Thanks,

Monica

Re: Microsoft Windows SChannel Malformed Certificate Request Remote Code Execution

mmorfoot — Thu, 26 Sep 2013 19:02:20 GMT

We are seeing the same thing for awhile now as well. It looks to be something with users accessing GMAIL.

Re: Microsoft Windows SChannel Malformed Certificate Request Remote Code Execution

kadak — Thu, 26 Sep 2013 21:32:37 GMT

Hello Monica,

MS10-049 :

There is a remote code execution vulnerability in Microsoft Windows SChannel when it validates a certificate request message sent by the server on a client. An attacker could host a specially crafted Web site that is designed to exploit these vulnerabilities through an Internet Web browser and then convince a user to view the Web site.

More information on it can be found at:

Microsoft Security Bulletin MS10-049 - Critical : Vulnerabilities in SChannel could allow Remote Code Execution (980436)

Also, its known by CVE - 2010-2566. More information on that can be found at : CVE -CVE-2010-2566

Our threat database does cover the signature by threat ID: 33372

Hope that is the information you were looking for.

Regards,

Kunal Adak

Re: Microsoft Windows SChannel Malformed Certificate Request Remote Code Execution

SOC_CSG — Wed, 29 Oct 2014 17:29:07 GMT

Hi,

Is there any recommendation by Palo Alto?

I mean if is there any way to tackle this in our palo alto firewall?

Regards,:smileyinfo: