PT-2007-4735 · Check Point · Check Point Sofaware Safe@Office

Published 2007-06-27 · Updated 2018-10-16 · CVE-2007-3464

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Check Point SofaWare Safe@Office versions prior to Embedded NGX 7.0.45 GA

Description The issue allows attackers to gain privileges without requiring the old password when changing the admin password. This could be exploited through vectors such as CSRF attacks or making a password change on an unattended workstation.

Recommendations For versions prior to Embedded NGX 7.0.45 GA, update to Embedded NGX 7.0.45 GA or later to resolve the issue. As a temporary workaround, consider restricting access to the password change functionality to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-3464

Affected Products

Check Point Sofaware Safe@Office

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-3464 · Security Note
• http://labs.calyptix.com/CX-2007-04.php · Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35094 · Note
• http://osvdb.org/37644 · Note
• http://securityfocus.com/archive/1/472290/100/0/threaded · Note
• http://labs.calyptix.com/CX-2007-04.txt · Note