PT-2007-1936 · Check Point · Check Point Vpn-1 Ngx R62+2

Nir Goldshlager + 1 · Published 2007-01-24 · Updated 2018-10-16 · CVE-2007-0471

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Check Point Connectra NGX R62 versions 3.x and earlier before Security Hotfix 5 Check Point VPN-1 NGX R62 (affected versions not specified)

Description The issue allows remote attackers to bypass security requirements. This is achieved by sending a crafted Report parameter to the sre/params.php file in the Integrity Clientless Security (ICS) component, which then returns a valid ICSCookie authentication token.

Recommendations For Check Point Connectra NGX R62 versions 3.x and earlier, apply Security Hotfix 5 to resolve the issue. For Check Point VPN-1 NGX R62, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2007-0471

Affected Products

Check Point Connectra Ngx R62

Check Point Vpn-1 Ngx R62

Integrity Clientless Security

References · 15

• 🔥 http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051920.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-0471 · Security Note
• http://vupen.com/english/advisories/2007/0276 · Vendor Advisory
• http://secunia.com/advisories/23847 · Vendor Advisory
• http://securitytracker.com/id?1017559 · Note
• http://securityfocus.com/archive/1/457683/100/0/threaded · Note
• http://secureknowledge.checkpoint.com/SecureKnowledge/viewSolutionDocument.do?lid=sk32472 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31646 · Note
• http://updates.checkpoint.com/fileserver/ID/7126/FILE/VPN-1_Hotfix1.pdf · Note
• http://securitytracker.com/id?1017560 · Note
• http://checkpoint.com/downloads/latest/hfa/connectra/security_r62.html · Note
• http://securityreason.com/securityalert/2179 · Note
• http://checkpoint.com/downloads/latest/hfa/vpn1_security/vpn1_R62_Windows.html · Note
• http://osvdb.org/31655 · Note
• http://securityfocus.com/archive/1/457621/100/0/threaded · Note