Microsoft Windows SChannel Malformed Certificate Request Remote Code Execution

[MLaden]

Hi.

Can anyone provide insight into the threat signature for MS10-049?   What it triggers on, etc.?  I have seen this triggered by Goggle domain IP sources that produce certificate errors.

Thanks,

Monica

[mmorfoot]

We are seeing the same thing for awhile now as well.  It looks to be something with users accessing GMAIL.

[kadak · Accepted solution]

Hello Monica,

MS10-049 :

There is a remote code execution vulnerability in Microsoft Windows SChannel when it validates a certificate request message sent by the server on a client. An attacker could host a specially crafted Web site that is designed to exploit these vulnerabilities through an Internet Web browser and then convince a user to view the Web site.

More information on it can be found at:

Microsoft Security Bulletin MS10-049 - Critical : Vulnerabilities in SChannel could allow Remote Cod...

Also, its known by CVE - 2010-2566. More information on that can be found at : CVE -CVE-2010-2566

Our threat database does cover the signature by threat ID: 33372

Hope that is the information you were looking for.

Regards,

Kunal Adak

[SOC_CSG]

Hi,

Is there any recommendation by Palo Alto?

I mean if is there any way to tackle this in our palo alto firewall?

Regards,:smileyinfo: