Multiple Check Point SSL VPN On-Demand Applications Remote Code Execution Vulnerability

Bugtraq ID:	47695
Class:	Design Error
CVE:	CVE-2011-1827
Remote:	Yes
Local:	No
Published:	May 03 2011 12:00AM
Updated:	Aug 18 2011 06:50PM
Credit:	Johannes Greil of SEC Consult Unternehmensberatung
Vulnerable:	Check Point Software VSX R67 Check Point Software VSX R65.20 Check Point Software SecurePlatform R75 Check Point Software SecurePlatform R75 Check Point Software SecurePlatform R71.30 Check Point Software SecurePlatform R70.40 Check Point Software SecurePlatform R70.40 Check Point Software SecurePlatform R65.70 Check Point Software IPSO6 R75 Check Point Software IPSO6 R71.30 Check Point Software IPSO6 R70.40 Check Point Software IPSO6 R65.70 Check Point Software Connectra R66.1n Check Point Software Connectra R66.1
Not Vulnerable:

Multiple Check Point SSL VPN On-Demand Applications Remote Code Execution Vulnerability

Multiple Check Point SSL VPN on-demand applications are prone to a remote code-execution vulnerability.

Successful exploits will allow the attacker to execute arbitrary code within the context of the currently logged-in user. Failed exploit attempts will likely result in a denial-of-service condition.

Multiple Check Point SSL VPN On-Demand Applications Remote Code Execution Vulnerability

An exploit code and a video demonstrating the vulnerability is available. Please see the references for more information.

Multiple Check Point SSL VPN On-Demand Applications Remote Code Execution Vulnerability

Solution:
The vendor has released an advisory and fixes. Please see the references for more information.

Multiple Check Point SSL VPN On-Demand Applications Remote Code Execution Vulnerability

References:

• Check Point SSL VPN On-Demand applications Client-side remote file upload & comm (SEC Consult Vulnerability Lab)
  
• Microsoft Security Advisory 2562937 (Microsoft)
  
• Vendor Homepage (Check Point Software)
  
• Security issue in SSL VPN On-Demand applications (Check Point)