IKEView.exe R60 - Stack Buffer Overflow (PoC)

IKEView.exe R60 - Stack Buffer Overflow PoC + Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-IKEVIEWR60-0914.txt Vendor: ================================ www.checkpoint.com http://pingtool.org/downloads/IKEView.exe Product:...

CVE-2008-1397

Check Point VPN-1 Power/UTM, with NGX R60 through R65 and NG AI R55 software, allows remote authenticated users to cause a denial of service site-to-site VPN tunnel outage, and possibly intercept network traffic, by configuring the local RFC1918 IP address to be the same as one of this tunnel's...

CVE-2008-1397

Affected product/versions: Check Point VPN-1 Power/UTM, NGX R60–R65 and NG AI R55. Vulnerability: remote authenticated users can cause a site-to-site VPN tunnel outage and possibly intercept traffic by configuring the local RFC1918 IP address to match an endpoint RFC1918 address, then using SecuR...

Design/Logic Flaw

The Auto Local Logon feature in Check Point VPN-1 SecuRemote/SecureClient NGX R60 and R56 for Windows caches credentials under the Checkpoint\SecuRemote registry key, which has Everyone/Full Control permissions, which allows local users to gain privileges by reading and reusing the credentials...

CVE-2005-2889

Check Point NGX R60 does not properly verify packets against the predefined service group "CIFS" rule, which allows remote attackers to bypass intended restrictions...

CVE-2005-2889

CVE-2005-2889 concerns Check Point NGX R60 where the CIFS service group implementation may mishandle traffic not designated as CIFS. The CERT/Check Point entry notes that the CIFS service group could allow unintended traffic to pass or cause legitimate traffic to be dropped, depending on rule con...

Rule bypassing in CheckPoint NGX R60

Hi folks, as playing a little bit with CheckPoint NGX new release R60, I noticed a serious problem with the predefined service group "CIFS". This group includes the services called "microsoft-ds" TCP Port 445 and the predefined service group "NBT", which includes some old smb-stuff. If I use this...