CVE-2003-0757: Undefined Security Weakness

Check Point FireWall-1 4.0 and 4.1 before SP5 allows remote attackers to obtain the IP addresses of internal interfaces via certain SecuRemote requests to TCP ports 256 or 264, which leaks the IP addresses in a reply packet...

CVE-2001-1303

The CVE-2001-1303 entry describes an information-disclosure vulnerability in Check Point Firewall-1 where SecuRemote’s default configuration allows remote attackers to obtain sensitive configuration information for the protected network without authentication. Affected component: SecuRemote (part...

CVE-2001-1303: Undefined Security Weakness

The default configuration of SecuRemote for Check Point Firewall-1 allows remote attackers to obtain sensitive configuration information for the protected network without authentication...

CVE-2002-2405

Check Point FireWall-1 4.1 and Next Generation NG, with UserAuth configured to proxy HTTP traffic only, allows remote attackers to pass unauthorized HTTPS, FTP and possibly other traffic through the firewall...

Firewall-1 usernames detection

PKI aggressive mode replies are different for existing and non-existing usernames...

SecuRemote usernames can be guessed or sniffed using IKE exchange

SecuRemote usernames can be guessed or sniffed using IKE exchange Introduction: ------------- While performing a VPN security analysis for one of our customers, I discovered a potential issue with Firewall-1 SecuRemote IKE which can allow usernames to be guessed. I also observed the related issue...

CVE-2002-0428

Check Point FireWall-1 SecuRemote/SecuClient 4.0 and 4.1 allows clients to bypass the "authentication timeout" by modifying the toexpire or expire values in the client's users.C configuration file...

CVE-2001-1158

Check Point VPN-1/FireWall-1 4.1 base.def contains a default macro, acceptfw1rdp, which can allow remote attackers to bypass intended restrictions with forged RDP internal protocol headers to UDP port 259 of arbitrary hosts...

CVE-2001-0940

Buffer overflow in the GUI authentication code of Check Point VPN-1/FireWall-1 Management Server 4.0 and 4.1 allows remote attackers to execute arbitrary code via a long user name...

CVE-2001-1158

Affected software: Check Point VPN-1/FireWall-1 (version 4.0 and 4.1 per CERT) with the default macro accept_fw1_rdp in base.def. Vulnerability: A forged RDP header sent over UDP port 259 can bypass firewall restrictions, allowing traffic to arbitrary hosts. This is achieved by abusing RDP suppor...

CVE-2001-1176

CVE-2001-1176 describes a format-string vulnerability in Check Point VPN-1/FireWall-1 4.1. The issue allows a remote authenticated firewall administrator to execute arbitrary code via format strings in the control connection. Exploitation details are not provided in the connected documents; no ex...

CVE-2001-0940: Undefined Security Weakness

Buffer overflow in the GUI authentication code of Check Point VPN-1/FireWall-1 Management Server 4.0 and 4.1 allows remote attackers to execute arbitrary code via a long user name...

CVE-2001-1176: Undefined Security Weakness

Format string vulnerability in Check Point VPN-1/FireWall-1 4.1 allows a remote authenticated firewall administrator to execute arbitrary code via format strings in the control connection...

CVE-2001-1158: Undefined Security Weakness

Check Point VPN-1/FireWall-1 4.1 base.def contains a default macro, acceptfw1rdp, which can allow remote attackers to bypass intended restrictions with forged RDP internal protocol headers to UDP port 259 of arbitrary hosts...

CVE-2002-0428

Check Point FireWall-1 SecuRemote/SecuClient 4.0 and 4.1 allows clients to bypass the "authentication timeout" by modifying the toexpire or expire values in the client's users.C configuration file...

CVE-2002-0428

The CVE-2002-0428 issue affects Check Point FireWall-1 SecuRemote/SecuClient 4.0 and 4.1. A vulnerability in the client configuration allows bypassing the authentication timeout by modifying the to_expire or expire values in the users.C file, potentially extending session validity beyond intended...

CVE-2002-0428: Undefined Security Weakness

Check Point FireWall-1 SecuRemote/SecuClient 4.0 and 4.1 allows clients to bypass the "authentication timeout" by modifying the toexpire or expire values in the client's users.C configuration file...

CVE-2001-1171

Check Point Firewall-1 3.0b through 4.0 SP1 follows symlinks and creates a world-writable temporary .cpp file when compiling Policy rules, which could allow local users to gain privileges or modify the firewall policy...

CVE-2001-1101

The Log Viewer function in the Check Point FireWall-1 GUI for Solaris 3.0b through 4.1 SP2 does not check for the existence of '.log' files when saving files, which allows 1 remote authenticated users to overwrite arbitrary files ending in '.log', or 2 local users to overwrite arbitrary files via...

CVE-2001-1171

The CVE affects Check Point Firewall-1, version 3.0b through 4.0 SP1. The root cause is a symlink-following issue during policy rule compilation that creates a world-writable temporary .cpp file, enabling local users to gain privileges or modify the firewall policy. No exploitation details or in-...