PT-2013-5703 · Check Point · Check Point Endpoint Security

Published 2013-11-30 · Updated 2013-12-02 · CVE-2013-5635

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Check Point Endpoint Security versions through E80.50

Description The issue arises from the Media Encryption EPM Explorer in Check Point Endpoint Security, which fails to properly maintain the state of password failures. This makes it easier for physically proximate attackers to bypass the device-locking protection mechanism. Attackers can achieve this by entering password guesses within multiple Unlock.exe processes that are running simultaneously.

Recommendations For versions through E80.50, consider disabling the Unlock.exe process until a patch is available to prevent exploitation. Restrict physical access to devices to minimize the risk of attackers bypassing the device-locking protection mechanism.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2013-5635

Affected Products

Check Point Endpoint Security

References · 3

• https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk96589 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2013-5635 · Security Note
• http://digitalsec.net/stuff/explt+advs/CheckPoint_EndPoint_EPM_Explorer.txt · Note