Details of VAR-201401-0482

ID

VAR-201401-0482

CVE

CVE-2013-7304

TITLE

Check Point Endpoint Security MI Server In SSL Vulnerability impersonating a server

Trust: 0.8

sources: JVNDB: JVNDB-2013-005896

DESCRIPTION

Check Point Endpoint Security MI Server through R73 3.0.0 HFA2.5 does not configure X.509 certificate validation for client devices, which allows man-in-the-middle attackers to spoof SSL servers by presenting an arbitrary certificate during a session established by a client. Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks. Check Point Endpoint Security is a set of endpoint security solutions from Check Point Company in the United States. This solution combines firewall, network access control, anti-virus, anti-spyware, data security and other functions to ensure that terminal PCs are free from Web-based threats. The vulnerability is caused by the fact that the program does not verify the X.509 certificate configured on the client device

Trust: 1.98

sources: NVD: CVE-2013-7304 // JVNDB: JVNDB-2013-005896 // BID: 65135 // VULHUB: VHN-67306

AFFECTED PRODUCTS

vendor:	checkpoint	model:	endpoint security mi server r73	scope:	lte	version:	3.0.0	Trust: 1.0
vendor:	check point	model:	endpoint security mi server r73	scope:	lte	version:	3.0.0 hfa2.5	Trust: 0.8
vendor:	checkpoint	model:	endpoint security mi server r73	scope:	eq	version:	3.0.0	Trust: 0.6

sources: JVNDB: JVNDB-2013-005896 // CNNVD: CNNVD-201401-423 // NVD: CVE-2013-7304

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2013-7304
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2013-7304
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201401-423
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-67306
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2013-7304
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-67306
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-67306 // JVNDB: JVNDB-2013-005896 // CNNVD: CNNVD-201401-423 // NVD: CVE-2013-7304

PROBLEMTYPE DATA

problemtype:

CWE-310

Trust: 1.9

sources: VULHUB: VHN-67306 // JVNDB: JVNDB-2013-005896 // NVD: CVE-2013-7304

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201401-423

TYPE

encryption problem

Trust: 0.6

sources: CNNVD: CNNVD-201401-423

CONFIGURATIONS

sources: JVNDB: JVNDB-2013-005896

PATCH

title:	Endpoint Security MI Server R73 certificate validation	url:	https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk97784	Trust: 0.8
title:	EPS_MI_R73_HF_sk97784	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=48381	Trust: 0.6

sources: JVNDB: JVNDB-2013-005896 // CNNVD: CNNVD-201401-423

EXTERNAL IDS

db:	NVD	id:	CVE-2013-7304	Trust: 2.8
db:	BID	id:	65135	Trust: 1.4
db:	SECTRACK	id:	1029704	Trust: 1.1
db:	SECUNIA	id:	56744	Trust: 1.1
db:	JVNDB	id:	JVNDB-2013-005896	Trust: 0.8
db:	CNNVD	id:	CNNVD-201401-423	Trust: 0.7
db:	VULHUB	id:	VHN-67306	Trust: 0.1

sources: VULHUB: VHN-67306 // BID: 65135 // JVNDB: JVNDB-2013-005896 // CNNVD: CNNVD-201401-423 // NVD: CVE-2013-7304

REFERENCES

url:	https://supportcenter.checkpoint.com/supportcenter/portal?eventsubmit_dogoviewsolutiondetails=&solutionid=sk97784	Trust: 1.6
url:	http://www.securityfocus.com/bid/65135	Trust: 1.1
url:	http://www.securitytracker.com/id/1029704	Trust: 1.1
url:	http://secunia.com/advisories/56744	Trust: 1.1
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/90674	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-7304	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-7304	Trust: 0.8
url:	https://supportcenter.checkpoint.com/supportcenter/portal?eventsubmit_dogoviewsolutiondetails=&solutionid=sk97784	Trust: 0.1

sources: VULHUB: VHN-67306 // JVNDB: JVNDB-2013-005896 // CNNVD: CNNVD-201401-423 // NVD: CVE-2013-7304

CREDITS

Alberto Garcia Illera

Trust: 0.3

sources: BID: 65135

SOURCES

db:	VULHUB	id:	VHN-67306
db:	BID	id:	65135
db:	JVNDB	id:	JVNDB-2013-005896
db:	CNNVD	id:	CNNVD-201401-423
db:	NVD	id:	CVE-2013-7304

LAST UPDATE DATE

2025-04-11T23:09:47.764000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-67306	date:	2017-08-29T00:00:00
db:	BID	id:	65135	date:	2014-01-24T00:00:00
db:	JVNDB	id:	JVNDB-2013-005896	date:	2014-01-24T00:00:00
db:	CNNVD	id:	CNNVD-201401-423	date:	2014-01-24T00:00:00
db:	NVD	id:	CVE-2013-7304	date:	2025-04-11T00:51:21.963

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-67306	date:	2014-01-22T00:00:00
db:	BID	id:	65135	date:	2014-01-24T00:00:00
db:	JVNDB	id:	JVNDB-2013-005896	date:	2014-01-24T00:00:00
db:	CNNVD	id:	CNNVD-201401-423	date:	2014-01-24T00:00:00
db:	NVD	id:	CVE-2013-7304	date:	2014-01-22T19:55:06.550