A Stateful Inspection of FireWall-1

A Stateful Inspection of FireWall-1 Thomas Lopatic, John McDonald TUV data protect GmbH tl,[email protected] Dug Song Center for Information Technology Integration University of Michigan [email protected] 1 Introduction -------------- At the Black Hat Briefings 2000, we presented an analysis of...

CVE-2000-0582

Check Point FireWall-1 4.0 and 4.1 allows remote attackers to cause a denial of service by sending a stream of invalid commands such as binary zeros to the SMTP Security Server proxy...

Check Point Software Firewall-1 4.01.4.1 - Resource Exhaustion (Denial of Service)

Check Point Software Firewall-1 4.01.4.1 - Resource Exhaustion Denial of Service source: https://www.securityfocus.com/bid/1416/info The Check Point Firewall-1 SMTP Security Server in Firewall-1 4.0 and 4.1 on Windows NT is vulnerable to a simple network-based attack which can increase the...

CVE-2000-0482

Check Point Firewall-1 allows remote attackers to cause a denial of service by sending a large number of malformed fragmented IP packets...

Check Point Software Firewall-1 4.0/1 4.1 - Fragmented Packets Denial of Service

// source: https://www.securityfocus.com/bid/1312/info By sending illegally fragmented packets directly to or routed through Check Point FireWall-1, it is possible to force the firewall to use 100% of available processor time logging these packets. The FireWall-1 rulebase cannot prevent this atta...

Check Point Software Firewall-1 4.01 4.1 - Fragmented Packets Denial of Service

Check Point Software Firewall-1 4.01 4.1 - Fragmented Packets Denial of Service // source: https://www.securityfocus.com/bid/1312/info By sending illegally fragmented packets directly to or routed through Check Point FireWall-1, it is possible to force the firewall to use 100% of available...

CVE-2000-0181

Firewall-1 3.0 and 4.0 leaks packets with private IP address information, which could allow remote attackers to determine the real IP address of the host that is making the connection...

CVE-1999-0895

The provided data identifies CVE-1999-0895 affecting Firewall-1, in which LDAP attributes are not properly restricted. The entry describes a network-exposed issue with no authentication required, leading to partial disclosure/integrity/availability impact (CVSS v2 base score 7.5, HIGH). No concre...

CVE-1999-0895

Firewall-1 does not properly restrict access to LDAP attributes...

CVE-2000-0181

CVE-2000-0181 affects Check Point Firewall-1 3.0 and 4.0, where leaked packets can reveal private IP addresses, allowing remote attackers to infer the real IP of the host initiating the connection. The vulnerability is a confidentiality issue (PARTIAL impact) with network attack vector and no aut...

CVE-2000-0181: Undefined Security Weakness

Firewall-1 3.0 and 4.0 leaks packets with private IP address information, which could allow remote attackers to determine the real IP address of the host that is making the connection...

CVE-1999-0895: Undefined Security Weakness

Firewall-1 does not properly restrict access to LDAP attributes...

CVE-2000-0150: Undefined Security Weakness

Check Point Firewall-1 allows remote attackers to bypass port access restrictions on an FTP server by forcing it to send malicious packets that Firewall-1 misinterprets as a valid 227 response to a client's PASV attempt...

CVE-2000-0181

Firewall-1 3.0 and 4.0 leaks packets with private IP address information, which could allow remote attackers to determine the real IP address of the host that is making the connection...

Check Point Software Firewall-1 3.0/1 4.0 / Cisco PIX Firewall 4.x/5.x - 'ALG' Client

// source: https://www.securityfocus.com/bid/1045/info A vulnerability exists in the handling of certain rules on many firewalls, that may allow users outside of the firewall to gain limited access to areas behind firewalls. Whereas previous descriptions of attacks of this style were server based...

CVE-2000-0150

Check Point Firewall-1 allows remote attackers to bypass port access restrictions on an FTP server by forcing it to send malicious packets that Firewall-1 misinterprets as a valid 227 response to a client's PASV attempt...

fw1-ftp.txt

FireWall-1 FTP Server Vulnerability Background Paper 1, data protect AG John McDonald Thomas Lopatic References ---------- Please reference the recent vuln-dev posting by Mikael Olsson entitled, "Breaking through FTP ALGs -- is it possible?" At the time of this writing, it was not yet archived on...

fw1-pasv.txt

Multiple firewalls: FTP Application Level Gateway "PASV" Vulnerability Synopsis -------- It is possible to cause certain firewalls to open up any TCP port of your choice against FTP servers that are "protected" by those firewalls. This is done by fooling the FTP server into echoing "227 PASV"...

CVE-2000-0116

Firewall-1 does not properly filter script tags, which allows remote attackers to bypass the "Strip Script Tags" restriction by including an extra in front of the SCRIPT tag...

Check Point Software Firewall-1 3.0 Script - Tag Checking Bypass

source: https://www.securityfocus.com/bid/954/info Firewall-1 includes the ability to alter script tags in HTML pages before passing them to the client's browser. This alteration invalidates the tag, rendering the script unexecutable by the browser. In version 3, this function can be bypassed by...