Check Point Firewall-1 Internal Address Leakage Vulnerability
BID:1054
Info
Check Point Firewall-1 Internal Address Leakage Vulnerability
| Bugtraq ID: | 1054 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 11 2000 12:00AM |
| Updated: | Mar 11 2000 12:00AM |
| Credit: | This vulnerability was posted to the Bugtraq mailing list by Chris Brenton <[email protected]> on March 11, 2000. |
| Vulnerable: |
Check Point Software Firewall-1 4.1 Check Point Software Firewall-1 4.0 Check Point Software Firewall-1 3.0 |
| Not Vulnerable: | |
Discussion
Check Point Firewall-1 Internal Address Leakage Vulnerability
A vulnerability exists in which Checkpoint Firewall-1 will expose internal addresses to machines outside the network. Under seemingly normal load conditions, according to the poster of this vulnerability, 40% CPU utilization with 200+ active connections, Firewall-1 will attempt to establish connections utilizing the internal address. As this address is either non-routable, or internal, a retransmission will occur; this packet will have the correct address rewritten, but will use the same source port. Using this information makes it easy to determine the firewall behind which this address resides, as well as the internal address of the machine being utilized to establish the connection being seen. This may be particularly useful to attackers conducting client side attacks.
These problems have been seen on both NT and Solaris versions of FW-1, although the poster indicated that not enough data was available to directly state the Solaris version was vulnerable in the same ways, or to the same degrees.
A vulnerability exists in which Checkpoint Firewall-1 will expose internal addresses to machines outside the network. Under seemingly normal load conditions, according to the poster of this vulnerability, 40% CPU utilization with 200+ active connections, Firewall-1 will attempt to establish connections utilizing the internal address. As this address is either non-routable, or internal, a retransmission will occur; this packet will have the correct address rewritten, but will use the same source port. Using this information makes it easy to determine the firewall behind which this address resides, as well as the internal address of the machine being utilized to establish the connection being seen. This may be particularly useful to attackers conducting client side attacks.
These problems have been seen on both NT and Solaris versions of FW-1, although the poster indicated that not enough data was available to directly state the Solaris version was vulnerable in the same ways, or to the same degrees.
Exploit / POC
Check Point Firewall-1 Internal Address Leakage Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Check Point Firewall-1 Internal Address Leakage Vulnerability
Solution:
It has been reported that a service pack has been released by Checkpoint to address this problem. For FW-1 4.0, this is SP5. It is available at their website.
A suitable solution may be to establish egress filtering. Information can be found on this subject at: http://www.sans.org/y2k/egress.htm
Check Point Software Firewall-1 4.0
Solution:
It has been reported that a service pack has been released by Checkpoint to address this problem. For FW-1 4.0, this is SP5. It is available at their website.
A suitable solution may be to establish egress filtering. Information can be found on this subject at: http://www.sans.org/y2k/egress.htm
Check Point Software Firewall-1 4.0
-
Check Point Software SP5
http://www.checkpoint.com
References
Check Point Firewall-1 Internal Address Leakage Vulnerability
References:
References:
- Check Point Technical Support (Check Point Software)