ID

VAR-200701-0404

CVE

CVE-2007-0471

TITLE

Check Point Connectra NGX Vulnerabilities that bypass security requirements

DESCRIPTION

sre/params.php in the Integrity Clientless Security (ICS) component in Check Point Connectra NGX R62 3.x and earlier before Security Hotfix 5, and possibly VPN-1 NGX R62, allows remote attackers to bypass security requirements via a crafted Report parameter, which returns a valid ICSCookie authentication token. Multiple Check Point products are prone to a security-bypass vulnerability. An attacker can exploit this issue to access cookie data and then use it to bypass certain security restrictions. This issue may potentially allow an attacker to gain unauthorized access to the affected application. Check Point Connectra is a web security gateway that provides SSL VPN access and integrates endpoint security and application security within a unified solution. There are loopholes in Connectra's processing of endpoint access authentication. One of the main functions of Connectra is the comprehensive endpoint security service. Specifically, before the client connects to the internal network, it will perform a test on the client to check whether the computer has a security risk. If a risk is detected, it will prompt the user for details of the risk. information, and the user will be asked to test again before logging on to the network. After the user submits the request, the server will send Set-Cookie to the client. ---------------------------------------------------------------------- Secunia is proud to announce the availability of the Secunia Software Inspector. The Secunia Software Inspector is a free service that detects insecure versions of software that you may have installed in your system. When insecure versions are detected, the Secunia Software Inspector also provides thorough guidelines for updating the software to the latest secure version from the vendor. Try it out online: http://secunia.com/software_inspector/ ---------------------------------------------------------------------- TITLE: Check Point Products ICS Security Bypass SECUNIA ADVISORY ID: SA23847 VERIFY ADVISORY: http://secunia.com/advisories/23847/ CRITICAL: Less critical IMPACT: Security Bypass WHERE: >From remote OPERATING SYSTEM: Check Point Connectra Appliances http://secunia.com/product/13352/ SOFTWARE: http://secunia.com/product// Check Point VPN-1 Power NGX http://secunia.com/product/13348/ http://secunia.com/product// Check Point VPN-1 UTM NG AI http://secunia.com/product/13350/ Check Point VPN-1 Power NG AI http://secunia.com/product/13351/ Check Point VPN-1 UTM NGX http://secunia.com/product/13346/ DESCRIPTION: Roni Bachar and Nir Goldshlager have reported a vulnerability in Check Point products, which can be exploited by malicious people to bypass certain security restrictions. The problem is that /sre/params.php in ICS (Integrity Clientless Security) does not properly validate the data being sent to it. This can be exploited to receive a cookie, which can be used to bypass certain checks before being allowed to log in to the network, by sending a POST request with a valid report to the /sre/params.php page. Successful exploitation requires that the ICS feature is enabled. The vulnerability affects the following products and versions: * Connectra NGX R62 * Connectra NGX R61 * Connectra NGX R60 * Connectra 2.0 * VPN-1 Power/UTM (Pro/Express) NGX R62 * VPN-1 Power/UTM (Pro/Express) NGX R61 * VPN-1 Power/UTM (Pro/Express) NGX R60 * VPN-1 Power/UTM (Pro/Express) NG AI R55W * VPN-1 Power/UTM (Pro/Express) NG AI R55 SOLUTION: Apply hotfix. Connectra: http://www.checkpoint.com/downloads/latest/hfa/connectra/index.html VPN-1: http://www.checkpoint.com/downloads/latest/hfa/vpn1_security/index.html PROVIDED AND/OR DISCOVERED BY: Roni Bachar and Nir Goldshlager, Avnet ORIGINAL ADVISORY: Check Point: https://secureknowledge.checkpoint.com/SecureKnowledge/viewSolutionDocument.do?lid=sk32472 Full-Disclosure: http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051920.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

permissions and access control

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Roni Bachar roni@ avnet.co.il>)Nir Goldshlager

SOURCES

LAST UPDATE DATE

2025-04-10T23:01:23.479000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE