Advisory CA-2001-17

-----BEGIN PGP SIGNED MESSAGE----- CERT Advisory CA-2001-17 Check Point RDP Bypass Vulnerability Original release date: July 09, 2001 Last revised: -- Source: CERT/CC A complete revision history is at the end of this file. Systems Affected Check Point VPN-1 and FireWall-1 Version 4.1 Overview A...

Check Point FireWall-1 RDP Bypass Vulnerability

FOR PUBLIC RELEASE ------------------------------------------------------------------------ Inside Security GmbH Vulnerability Notification Revision 1.2 2001-07-09 ------------------------------------------------------------------------ The latest version of this document is available at...

CVE-2001-1158

Check Point VPN-1/FireWall-1 4.1 base.def contains a default macro, acceptfw1rdp, which can allow remote attackers to bypass intended restrictions with forged RDP internal protocol headers to UDP port 259 of arbitrary hosts...

Check Point RDP Bypass Vulnerability

Overview Check Point VPN-1/FireWall-1 version 4.0 & 4.1 may allow an intruder to pass traffic through the firewall on port 259. Description Firewall-1 and VPN-1 include support for RDP, but do not provide adequate security controls for RDP data. By adding a faked RDP header to typical UDP traffic...

Check Point FireWall-1 HTTP Client Authentication Detection

The Check Point FireWall-1 Client Authentication web server is used to authenticate a user via HTTP. Once authenticated, the user can get more privileges on the network ie: get access to hosts which were previously blocked by the firewall. C Tenable Network Security, Inc. include"compat.inc";...

Check Point FireWall-1 Telnet Client Authentication Detection

The Check Point FireWall-1 Client Authentication server is used to authenticate a user via telnet. Once authenticated, the user can get more privileges on the network ie, get access to hosts that were previously blocked by the firewall. C Tenable Network Security, Inc. include"compat.inc";...

CVE-2001-0082

Check Point VPN-1/FireWall-1 4.1 SP2 with Fastmode enabled allows remote attackers to bypass access restrictions via malformed, fragmented packets...

CVE-2001-0082

Check Point VPN-1/FireWall-1 4.1 SP2 with Fastmode enabled allows remote attackers to bypass access restrictions via malformed, fragmented packets...

CVE-2001-0082

Check Point VPN-1/FireWall-1 4.1 SP2 with Fastmode enabled is affected by CVE-2001-0082. The issue allows remote attackers to bypass access restrictions by sending malformed, fragmented packets, enabling partial confidentiality, integrity, and availability impacts. The primary documents do not pr...

CVE-2000-0808

The seed generation mechanism in the inter-module S/Key authentication mechanism in Check Point VPN-1/FireWall-1 4.1 and earlier allows remote attackers to bypass authentication via a brute force attack, aka "One-time s/key Password Authentication."...

CVE-2000-0809

Buffer overflow in Getkey in the protocol checker in the inter-module communication mechanism in Check Point VPN-1/FireWall-1 4.1 and earlier allows remote attackers to cause a denial of service...

CVE-2000-0813

Check Point VPN-1/FireWall-1 4.1 and earlier allows remote attackers to redirect FTP connections to other servers "FTP Bounce" via invalid FTP commands that are processed improperly by FireWall-1, aka "FTP Connection Enforcement Bypass."...

CVE-2000-0804

The vulnerability CVE-2000-0804 affects Check Point VPN-1/FireWall-1 4.1 and earlier. It is caused by a flaw in handling fragmented TCP connection requests or reopening closed one-way connections, allowing remote attackers to bypass the directionality check (One-way Connection Enforcement Bypass)...

CVE-2000-0806

The CVE-2000-0806 issue affects Check Point VPN-1/FireWall-1 4.1 and earlier, specifically the inter-module authentication mechanism (FWA1). The vulnerability allows remote attackers to cause a denial of service via inter-module communications bypass. The root cause is a flaw in FWA1 authenticati...

CVE-2000-0809

The vulnerability CVE-2000-0809 is a buffer overflow in the GetKey routine of the inter-module communication protocol checker (Getkey) in Check Point VPN-1/FireWall-1 4.1 and earlier. This flaw allows remote attackers to crash the firewall daemon, leaving policy enforcement in place but potential...

CVE-2000-0813

Technical details about CVE-2000-0813 are not publicly provided in the connected documents you supplied. The materials do not specify affected products/versions beyond Check Point VPN-1/FireWall-1 4.1 and earlier, nor concrete remediation steps. Monitor for updates.

CVE-2000-1032

CVE-2000-1032 affects Check Point Firewall-1 4.0 and earlier. The client authentication interface returns distinct error messages for invalid usernames versus invalid passwords, enabling remote attackers to enumerate valid usernames on the firewall. The existing records do not provide concrete de...

CVE-2000-0805

CVE-2000-0805 affects Check Point VPN-1/FireWall-1 4.1 and earlier. The issue is "Retransmission of Encapsulated Packets": any source can send specially encapsulated FWZ packets that bypass normal rule checks and anti-spoofing, effectively spoofing as a FWZ client. All versions prior to the relev...

CVE-2000-0807

The OPSEC Authentication Spoof issue (CVE-2000-0807) affects Check Point VPN-1/FireWall-1 prior to the patches described in the ISS/FireWall-1 vulnerability alert. The security hole arises in the OPSEC authentication mechanism, allowing a remote attacker to spoof authentication and gain access to...

CVE-2000-0808

CVE-2000-0808 affects Check Point VPN-1/FireWall-1 (4.1 and earlier). The S/Key inter-module authentication Brute Force Vulnerability allows remote attackers to bypass authentication by brute-forcing the secret key, potentially enabling access to protected assets. Impact aligns with partial confi...