Microsoft Updates Blocked by Threat Prevention | Chasys Draw IES BMP (CVE-2013-3928)

[Ddavila]

Hello everyone,

I'd like to share a discovery I made this week and would appreciate your opinion.

Technical support reported that they were having trouble updating Microsoft products, specifically the Office suite, using the Quick Installer, which performs automatic downloads and updates.

The problem was that the download would get stuck at 2%, 14%, etc., and wouldn't continue. After reviewing the data together, I found the following: 

An IPS Prevent log with the following information:

Attack Information: Chasys Draw IES BMP Buffer Overflow

Protection Name: Chasys Draw IES BMP Buffer Overflow

CVE: CVE-2013-3928

Destination: a23-48-246-138.deploy.static.akamaitechnologies.com (23.48.246.138)

Resource: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/16.0.19328.20178/stream.x64.x-none.dat 

It's important to note that we don't use Chasys Draw IES, which is an image editing program. Therefore, I think this is a clear false positive. What do you think?

Also, I find it curious that this Protection Name is detecting this traffic as malicious when the domains used are Office domains. Furthermore, according to the CVE, the traffic behavior should be related to a BMP format that doesn't appear to be present in the blocking resources.

Bypassing the protection name resolves the issue.

Taking advantage of this situation, do you know if these issues can be easily escalated to the Check Point team so they can investigate whether it's a bug in the IPS Protection update? I feel this could be a very serious problem.

One more question: to optimize my Threat Prevention profile, do you recommend disabling this protection since we don't use the software, or how would you handle it?

All your comments are appreciated.

Regards

[PhoneBoy]

Definitely sounds like a false positive issue, which should be reported to TAC.
From a performance perspective, disabling a specific signature doesn't usually change anything.
However, if it causes a false positive like this, especially if the protection is for a product you don't use, disabling it is completely reasonable. 

[Ddavila]

I will definitely open a case with the CAT team so they can review it and see if it's an error.

Thanks for your recommendations; I was interested to hear your opinions on this case.

[the_rock]

What remediation option does it give?