| GEN:SID | 1:2380 |
| Message | EXPLOIT ISAKMP fifth payload certificate request length overflow attempt |
| Summary | This event is generated when an attempt is made to exploit a known vulnerability in Checkpoint VPN-1.
|
| Impact | Unauthorized administrative access to Checkpoint VPN-1 systems
|
| Detailed Information | Checkpoint VPN-1, SecuRemote and SecureClient contain an error that affects the processing of large Certificate requests to the VPN service. By sending a large amount of data in the Certificate Request payload an attacker may cause a buffer overflow condition to occur, presenting an opportunity to execute code of their choosing with the privileges of the user running the service, usually root.
|
| Affected Systems | CheckPoint Software FW-1 1.4.1 Service packs prior to SP6 CheckPoint Software FW-1 Next Generation FP1, FP0 CheckPoint Software VPN-1 1.4.1 SP5a CheckPoint Software VPN-1 Next Generation FP1, FP0
|
| Attack Scenarios | An attacker could supply a large Certificate Request payload containing code to be executed on the system.
|
| Ease of Attack | Proof of concept code exists.
|
| Corrective Action | Upgrade to the latest non-affected version of the software
Apply the appropriate vendor supplied patches
|
| Additional References | |
| Rule References | bugtraq: 9582
cve: 2004-0040
|