Checkpoint SecuRemote information leakage

# OpenVAS Vulnerability Test
# $Id: securemote_info_leak.nasl 6056 2017-05-02 09:02:50Z teissa $
# Description: Checkpoint SecuRemote information leakage
#
# Authors:
# Noam Rathaus <[email protected]>
# Thanks to  Haroon Meer <[email protected]>
# Script audit and contributions from Carmichael Security <http://www.carmichaelsecurity.com>
# Erik Anderson <[email protected]>
# Added link to the Bugtraq message archive
#
# Copyright:
# Copyright (C) 2001 SecuriTeam
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License version 2,
# as published by the Free Software Foundation
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
#

tag_summary = "The remote host seems to be a Checkpoint FireWall-1 running SecuRemote.
The SecuRemote service contains a vulnerability that allows attackers
to gain information about the hosts, networks, and users configured on 
the Firewall.

This will enable attackers to focus their attack strategy.

You should not let this information leak out.";

tag_solution = "Either block the SecuRemote's ports (TCP 256 and 264) to untrusted networks, 
or upgrade to the latest version of Checkpoint's Firewall-1.

Workaround:
You could restrict the topology download, so that only authenticated 
users can download it.
Go to Policy Properties Desktop Security of your Policy Editor and 
uncheck 'respond to unauthenticated topology requests'.
After installing the Policy only authenticated Users can download 
the Topology.

Reference : http://online.securityfocus.com/archive/1/197566
            http://online.securityfocus.com/bid/3058

For More Information:
http://www.securiteam.com/securitynews/5HP0D2A4UC.html";


if(description)
{
 script_name("Checkpoint SecuRemote information leakage");

 script_id(10710);
 script_version("$Revision: 6056 $");
 script_tag(name:"last_modification", value:"$Date: 2017-05-02 11:02:50 +0200 (Tue, 02 May 2017) $");
 script_tag(name:"creation_date", value:"2005-11-03 14:08:04 +0100 (Thu, 03 Nov 2005)");
 script_bugtraq_id(3058);
 script_cve_id("CVE-2001-1303");
 script_tag(name:"cvss_base", value:"5.0");
 script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:P/I:N/A:N");


 script_category(ACT_GATHER_INFO);
  script_tag(name:"qod_type", value:"remote_analysis");
 script_family("Firewalls");
 script_copyright("This script is Copyright (C) 2001 SecuriTeam");
 script_dependencies("find_service.nasl");
 script_require_ports(256, 264);
 script_tag(name : "solution" , value : tag_solution);
 script_tag(name : "summary" , value : tag_summary);
 exit(0);
}

securemote_request_info = raw_string(
0x41, 0x00, 0x00, 0x00, # 00000030                    41 00 00 00                         A...
0x02, 0x59, 0x05, 0x21, # 00000030                    02 59 05 21                         .Y.!
0x00, 0x00, 0x00, 0x04, # 00000030                    00 00 00 04                         ....
0xD5, 0x7A, 0x9D, 0xF6, # 00000030                    D5 7A 9D F6                         .z..
0x00, 0x00, 0x00, 0x4C, # 00000030                    00 00 00 4C                         ...L
# 00000030                    28 74 6F 70 6F 6C 6F 67 79 2D       (topology-
# 00000040  72 65 71 75 65 73 74 0A 09 3A 63 61 6E 61 6D 65 request..:caname
# 00000050  20 28 69 6E 66 6F 72 6D 61 74 69 6F 6E 5F 6C 65 .(information_le
# 00000060  61 6B 29 0A 09 3A 63 68 61 6C 6C 65 6E 67 65 20 ak)..:challenge.
# 00000070  28 33 65 62 38 63 37 33 66 38 62 36 33 29 0A 29 (3eb8c73f8b63).)
# 00000080  0A 00                                           ..              
0x28, 0x74, 0x6F, 0x70, 0x6F, 0x6C, 0x6F, 0x67, 0x79, 0x2D,
0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x0A, 0x09, 0x3A, 0x63, 0x61, 0x6E, 0x61, 0x6D, 0x65,
0x20, 0x28, 0x69, 0x6E, 0x66, 0x6F, 0x72, 0x6D, 0x61, 0x74, 0x69, 0x6F, 0x6E, 0x5F, 0x6C, 0x65,
0x61, 0x6B, 0x29, 0x0A, 0x09, 0x3A, 0x63, 0x68, 0x61, 0x6C, 0x6C, 0x65, 0x6E, 0x67, 0x65, 0x20,
0x28, 0x33, 0x65, 0x62, 0x38, 0x63, 0x37, 0x33, 0x66, 0x38, 0x62, 0x36, 0x33, 0x29, 0x0A, 0x29,
0x0A, 0x00);

port = 0;
if (get_port_state(264))
{
 soc = open_sock_tcp(264);
 if(soc)
  {
   close(soc);
   port = 264;
   }
}

if(!port)
{
if (get_port_state(256))
 {
  port = 256;
 }
}

if (port)
{
 soc = open_sock_tcp(port);
 if (soc)
 {
  send (socket:soc, data:securemote_request_info);
  response = recv(socket:soc, length:8192);
  if (":reply" >< response)
  {
   len = strlen(response);
   loc = 0;
   for(i=0;i<len;i=i+1)
   {
    if(response[i] == raw_string(0x28))
    {
    loc = i;
    i = len + 1;
    }
   }

   response_filtered = "";
   for (i = loc; i < len; i = i + 1)
   {
    if (response[i] == raw_string(0x09))
    {
     response_filtered = string(response_filtered, " ");
    }
    else
    {
     response_filtered = string(response_filtered, response[i]);
    }
   }
   report = string(
"The remote host seems to be a Checkpoint FireWall-1 running SecuRemote.\n",
"The SecuRemote service contains a vulnerability that allows attackers\n",
"to gain information about the hosts, networks, and users configured on\n",
"the Firewall.\n\n",
"This will enable attackers to focus their attack strategy.\n",
"You should not let this information leak out.\n", 
"Here is the gathered data :\n\n",
response_filtered,
"\n\n",
"Solution: Either block the SecuRemote's ports (TCP 256 and 264) to untrusted networks,\n",
"or upgrade to the latest version of Checkpoint's Firewall-1.\n\n",
"Workaround: You could restrict the topology download, so that only authenticated\n",
"users can download it.\n",
"Go to Policy Properties Desktop Security of your Policy Editor and \n",
"uncheck 'respond to unauthenticated topology requests'.\n",
"After installing the Policy only authenticated Users can download \n",
"the Topology.\n\n",
"For More Information:\n",
"http://www.securiteam.com/securitynews/5HP0D2A4UC.html");
   security_message(port:port, data:report);
   set_kb_item(name:"Host/firewall", value:"Checkpoint Firewall-1");
  }
 }
}