PT-2013-5704 · Check Point · Check Point Endpoint Security

Published 2013-11-30 · Updated 2013-12-02 · CVE-2013-5636

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Check Point Endpoint Security versions through E80.50

Description The issue arises from the Unlock.exe in Media Encryption EPM Explorer, which fails to associate password failures with a device ID. This oversight allows physically proximate attackers to bypass the device-locking protection mechanism. Attackers can exploit this by overwriting DVREM.EPM with a copy of itself after each few password guesses, making it easier to bypass the protection.

Recommendations For Check Point Endpoint Security versions through E80.50, as a temporary workaround, consider implementing additional authentication measures or restricting physical access to devices until a patch is available.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2013-5636

Affected Products

Check Point Endpoint Security

References · 3

• https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk96589 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-5636 · Security Note
• http://digitalsec.net/stuff/explt+advs/CheckPoint_EndPoint_EPM_Explorer.txt · Note