Details of VAR-200409-0025

ID

VAR-200409-0025

CVE

CVE-2004-0699

TITLE

Check Point VPN-1 ASN.1 Buffer Overflow Vulnerability

Trust: 0.9

sources: BID: 10820 // CNNVD: CNNVD-200409-068

DESCRIPTION

Heap-based buffer overflow in ASN.1 decoding library in Check Point VPN-1 products, when Aggressive Mode IKE is implemented, allows remote attackers to execute arbitrary code by initiating an IKE negotiation and then sending an IKE packet with malformed ASN.1 data. A vulnerability exists in Check Point's VPN-1 Server, which is included in many Check Point products. This vulnerability may permit a remote attacker to compromise the gateway system. This issue results from insufficient boundary checks performed by the application when processing user-supplied data. This overflow occurs during the initial key exchange process, and can be triggered with a single UDP packet. Since ISAKMP uses the UDP transport, a spoofed source address can be used in an attack. Check Point reports that for a single packet attack to succeed, VPN-1 must be configured for aggressive mode key exchange. Without aggressive mode, an attacker must initiate a real key negotiation session. This vulnerability can lead to remote code execution in the context of the VPN-1 process. This can lead to a complete system compromise

Trust: 2.79

sources: NVD: CVE-2004-0699 // CERT/CC: VU#435358 // JVNDB: JVNDB-2004-000294 // BID: 10820 // VULHUB: VHN-9129 // VULMON: CVE-2004-0699

AFFECTED PRODUCTS

vendor:	checkpoint	model:	firewall-1	scope:	eq	version:	4.1	Trust: 1.6
vendor:	checkpoint	model:	vpn-1	scope:	eq	version:	*	Trust: 1.0
vendor:	check point	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	check point	model:	vpn-1/firewall-1	scope:	eq	version:	ng fp3	Trust: 0.8
vendor:	check point	model:	vpn-1/firewall-1	scope:	eq	version:	ng with application intelligence (r54)	Trust: 0.8
vendor:	check point	model:	vpn-1/firewall-1	scope:	eq	version:	ng with application intelligence (r55)	Trust: 0.8
vendor:	check point	model:	vpn-1/firewall-1	scope:	eq	version:	ng with application intelligence (r55w)	Trust: 0.8
vendor:	checkpoint	model:	vpn-1	scope:	-	version:	-	Trust: 0.6
vendor:	check	model:	point software vsx firewall-1 gx	scope:	-	version:	-	Trust: 0.3
vendor:	check	model:	point software vpn-1/firewall-1 vsx ng with ai release	scope:	eq	version:	2	Trust: 0.3
vendor:	check	model:	point software vpn-1/firewall-1 vsx ng with ai release	scope:	eq	version:	1	Trust: 0.3
vendor:	check	model:	point software vpn-1/firewall-1 vsx	scope:	eq	version:	2.0.1	Trust: 0.3
vendor:	check	model:	point software vpn-1 vsx	scope:	eq	version:	2.0.1	Trust: 0.3
vendor:	check	model:	point software ssl network extender	scope:	-	version:	-	Trust: 0.3
vendor:	check	model:	point software securemote ng with application intelligence r56	scope:	-	version:	-	Trust: 0.3
vendor:	check	model:	point software securemote	scope:	eq	version:	4.1	Trust: 0.3
vendor:	check	model:	point software securemote	scope:	eq	version:	4.0	Trust: 0.3
vendor:	check	model:	point software secureclient ng with application intelligence r56	scope:	-	version:	-	Trust: 0.3
vendor:	check	model:	point software secureclient	scope:	eq	version:	4.1	Trust: 0.3
vendor:	check	model:	point software secureclient	scope:	eq	version:	4.0	Trust: 0.3
vendor:	check	model:	point software provider-1 ng with application intelligence r55	scope:	-	version:	-	Trust: 0.3
vendor:	check	model:	point software provider-1 ng with application intelligence r54	scope:	-	version:	-	Trust: 0.3
vendor:	check	model:	point software ng-ai r55w	scope:	-	version:	-	Trust: 0.3
vendor:	check	model:	point software ng-ai r55	scope:	-	version:	-	Trust: 0.3
vendor:	check	model:	point software ng-ai r54	scope:	-	version:	-	Trust: 0.3
vendor:	check	model:	point software firewall-1 vsx ng with application intelligence	scope:	-	version:	-	Trust: 0.3
vendor:	check	model:	point software firewall-1 vsx	scope:	eq	version:	2.0.1	Trust: 0.3
vendor:	check	model:	point software firewall-1 next generation fp3	scope:	-	version:	-	Trust: 0.3
vendor:	check	model:	point software firewall-1 gx	scope:	eq	version:	2.5	Trust: 0.3
vendor:	check	model:	point software firewall-1 gx	scope:	eq	version:	2.0	Trust: 0.3

sources: CERT/CC: VU#435358 // BID: 10820 // JVNDB: JVNDB-2004-000294 // NVD: CVE-2004-0699 // CNNVD: CNNVD-200409-068

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD:	CVE-2004-0699
value:	HIGH
Trust: 1.8
CARNEGIE MELLON:	VU#435358
value:	15.75
Trust: 0.8
CNNVD:	CNNVD-200409-068
value:	HIGH
Trust: 0.6
VULHUB:	VHN-9129
value:	HIGH
Trust: 0.1
VULMON:	CVE-2004-0699
value:	HIGH
Trust: 0.1

NVD:
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	FALSE
obtainAllPrivilege:	FALSE
obtainUserPrivilege:	FALSE
obtainOtherPrivilege:	TRUE
userInteractionRequired:	FALSE
version:	2.0
Trust: 1.0
NVD:	CVE-2004-0699
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.9
VULHUB:	VHN-9129
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: CERT/CC: VU#435358 // VULHUB: VHN-9129 // VULMON: CVE-2004-0699 // JVNDB: JVNDB-2004-000294 // NVD: CVE-2004-0699 // CNNVD: CNNVD-200409-068

PROBLEMTYPE DATA

problemtype:

NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2004-0699

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200409-068

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-200409-068

CONFIGURATIONS

sources: NVD: CVE-2004-0699

PATCH

title:

asn1

url:

http://www.checkpoint.com/techsupport/alerts/asn1.html

Trust: 0.8

sources: JVNDB: JVNDB-2004-000294

EXTERNAL IDS

db:	CERT/CC	id:	VU#435358	Trust: 3.4
db:	NVD	id:	CVE-2004-0699	Trust: 2.9
db:	BID	id:	10820	Trust: 2.9
db:	SECUNIA	id:	12177	Trust: 2.6
db:	SECTRACK	id:	1010799	Trust: 1.8
db:	OSVDB	id:	8290	Trust: 1.8
db:	SECTRACK	id:	1010798	Trust: 0.8
db:	JVNDB	id:	JVNDB-2004-000294	Trust: 0.8
db:	CNNVD	id:	CNNVD-200409-068	Trust: 0.7
db:	XF	id:	16824	Trust: 0.6
db:	XF	id:	1	Trust: 0.6
db:	CIAC	id:	O-190	Trust: 0.6
db:	ISS	id:	20040728 CHECK POINT VPN-1 ASN.1 DECODING REMOTE COMPROMISE	Trust: 0.6
db:	VULHUB	id:	VHN-9129	Trust: 0.1
db:	VULMON	id:	CVE-2004-0699	Trust: 0.1

sources: CERT/CC: VU#435358 // VULHUB: VHN-9129 // VULMON: CVE-2004-0699 // BID: 10820 // JVNDB: JVNDB-2004-000294 // NVD: CVE-2004-0699 // CNNVD: CNNVD-200409-068

REFERENCES

url:	http://xforce.iss.net/xforce/alerts/id/178	Trust: 3.7
url:	http://www.checkpoint.com/techsupport/alerts/asn1.html	Trust: 2.9
url:	http://www.securityfocus.com/bid/10820	Trust: 2.7
url:	http://www.kb.cert.org/vuls/id/435358	Trust: 2.7
url:	http://secunia.com/advisories/12177/	Trust: 2.6
url:	http://www.ciac.org/ciac/bulletins/o-190.shtml	Trust: 2.6
url:	http://www.osvdb.org/displayvuln.php?osvdb_id=8290	Trust: 1.8
url:	http://securitytracker.com/alerts/2004/jul/1010799.html	Trust: 1.8
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/16824	Trust: 1.2
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2004-0699	Trust: 0.8
url:	http://nvd.nist.gov/nvd.cfm?cvename=cve-2004-0699	Trust: 0.8
url:	http://www.securitytracker.com/alerts/2004/jul/1010798.html	Trust: 0.8
url:	http://xforce.iss.net/xforce/xfdb/16824	Trust: 0.6
url:	http://www.checkpoint.com/techsupport/	Trust: 0.3
url:	https://cwe.mitre.org/data/definitions/.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: CERT/CC: VU#435358 // VULHUB: VHN-9129 // VULMON: CVE-2004-0699 // BID: 10820 // JVNDB: JVNDB-2004-000294 // NVD: CVE-2004-0699 // CNNVD: CNNVD-200409-068

CREDITS

Discovery of this vulnerability is credited to Mark Dowd and Neel Mehta of the Internet Security Systems X-Force.

Trust: 0.9

sources: BID: 10820 // CNNVD: CNNVD-200409-068

SOURCES

db:	CERT/CC	id:	VU#435358
db:	VULHUB	id:	VHN-9129
db:	VULMON	id:	CVE-2004-0699
db:	BID	id:	10820
db:	JVNDB	id:	JVNDB-2004-000294
db:	NVD	id:	CVE-2004-0699
db:	CNNVD	id:	CNNVD-200409-068

LAST UPDATE DATE

2023-12-18T11:11:09.710000+00:00

SOURCES UPDATE DATE

db:	CERT/CC	id:	VU#435358	date:	2004-08-10T00:00:00
db:	VULHUB	id:	VHN-9129	date:	2017-07-11T00:00:00
db:	VULMON	id:	CVE-2004-0699	date:	2017-07-11T00:00:00
db:	BID	id:	10820	date:	2009-07-12T06:16:00
db:	JVNDB	id:	JVNDB-2004-000294	date:	2007-04-01T00:00:00
db:	NVD	id:	CVE-2004-0699	date:	2017-07-11T01:30:23.543
db:	CNNVD	id:	CNNVD-200409-068	date:	2005-10-20T00:00:00

SOURCES RELEASE DATE

db:	CERT/CC	id:	VU#435358	date:	2004-08-02T00:00:00
db:	VULHUB	id:	VHN-9129	date:	2004-09-28T00:00:00
db:	VULMON	id:	CVE-2004-0699	date:	2004-09-28T00:00:00
db:	BID	id:	10820	date:	2004-07-28T00:00:00
db:	JVNDB	id:	JVNDB-2004-000294	date:	2007-04-01T00:00:00
db:	NVD	id:	CVE-2004-0699	date:	2004-09-28T04:00:00
db:	CNNVD	id:	CNNVD-200409-068	date:	2004-09-28T00:00:00