PT-2008-2978 · Check Point · Check Point Vpn-1 Power/Utm

Robert Mitchell · Published 2008-03-20 · Updated 2017-08-08 · CVE-2008-1397

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Check Point VPN-1 Power/UTM versions NGX R60 through R65 Check Point VPN-1 Power/UTM version NG AI R55

Description The issue allows remote authenticated users to cause a denial of service, potentially leading to a site-to-site VPN tunnel outage, and possibly intercept network traffic. This can be achieved by configuring the local RFC1918 IP address to be the same as one of the tunnel's endpoint RFC1918 IP addresses and then using SecuRemote to connect to a network interface at the other endpoint.

Recommendations For Check Point VPN-1 Power/UTM versions NGX R60 through R65, consider reconfiguring the local RFC1918 IP address to avoid matching the tunnel's endpoint RFC1918 IP addresses. For Check Point VPN-1 Power/UTM version NG AI R55, restrict access to SecuRemote to prevent unauthorized connections to network interfaces at the other endpoint.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-1397

Affected Products

Check Point Vpn-1 Power/Utm

References · 10

• 🔥 http://puresecurity.com.au/files/PureSecurity%20VPN-1%20DoS_Spoofing%20Attack%20against%20VPN%20tunnels.pdf · Exploit
• http://secunia.com/advisories/29394 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1397 · Security Note
• https://supportcenter.checkpoint.com/supportcenter/portal?solutionid=sk34579 · Patch
• http://securitytracker.com/id?1019666 · Note
• http://vupen.com/english/advisories/2008/0953/references · Note
• http://kb.cert.org/vuls/id/992585 · Note
• http://puresecurity.com.au/index.php?action=fullnews&id=5 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41260 · Note
• http://securityfocus.com/bid/28299 · Note