PT-2001-2244 · Check Point · Check Point Firewall-1 Gui

Publicado 2001-09-08 · Atualizado 2017-12-19 · CVE-2001-1101

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Check Point FireWall-1 GUI for Solaris versions 3.0b through 4.1 SP2

Description The issue concerns the Log Viewer function, which does not properly check for the existence of '.log' files when saving. This allows remote authenticated users to overwrite arbitrary files with a '.log' extension. Additionally, local users can exploit this by using a symlink attack to overwrite arbitrary files.

Recommendations For versions 3.0b through 4.1 SP2, consider restricting access to the Log Viewer function until a proper fix is applied, and avoid using the function to save files that could potentially overwrite critical system or configuration files. As a temporary workaround, consider implementing additional file system permissions or access controls to limit the ability of remote authenticated and local users to overwrite sensitive files.

Correção

Identificadores relacionados

CVE-2001-1101

Produtos afetados

Check Point Firewall-1 Gui

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2001-1101 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1101 · Nota
• http://securityfocus.com/bid/3303 · Aviso do Fabricante
• http://securityfocus.com/archive/1/212826 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7095 · Nota