Title: Check Point VPN-1 ISAKMP Remote Buffer Overflow Vulnerability
Severity: CRITICAL
Description:
VPN-1 is the firewall and virtual private network software package distributed by Check Point Software Technologies.
A vulnerability has been identified in the application that may allow a remote attacker to execute arbitrary code in order to gain unauthorized access. This issue results from insufficient boundary checks performed by the application when processing user-supplied data.
The issue is reported to present itself in Check Point VPN-1 products during negotiations of a VPN tunnel. Specifically, a buffer overflow condition may be triggered by sending a malformed ISAKMP packet during the negotiations. An attacker could take advantage of this issue to exploit the buffer overflow in a vulnerable gateway resulting in the execution of attacker-supplied code with the privileges of the software. It is conjectured that vulnerable applications are usually run as the administrative user in typical configurations. If an attacker can gain unauthorized access to the gateway, further attacks against the internal network are also possible.
Check Point Software user who do not use Remote Access VPNs or gateway-to-gateway VPNs are not vulnerable to this issue.
Due to a lack of details, further information cannot be provided at the moment. This BID will be updated as more information becomes available.
Affected Products:
- Check Point Software FireWall-1 GX 2.0.0
- Check Point Software FireWall-1 VSX 2.0.1
- Check Point Software FireWall-1 VSX NG with Application Intelligence
- Check Point Software NG-AI R54
- Check Point Software NG-AI R55
- Check Point Software Next Generation FP3
- Check Point Software Next Generation FP3 HF1
- Check Point Software Next Generation FP3 HF2
- Check Point Software SecuRemote NG with Application Intelligence R56
- Check Point Software SecureClient NG with Application Intelligence R56
- Check Point Software VPN-1 VSX 2.0.1
- Check Point Software VPN-1 VSX NG with Application Intelligence
References:
- Check Point Software: ISAKMP Vulnerability
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
