FW: CERT Advisory CA-2001-17
lrandall at isa-inc.com
Mon Jul 9 15:43:42 EDT 2001
Everyone catch this yet:
From: CERT Advisory [mailto:cert-advisory at cert.org]
Sent: Monday, July 09, 2001 1:33 PM
To: cert-advisory at cert.org
Subject: CERT Advisory CA-2001-17
-----BEGIN PGP SIGNED MESSAGE-----
CERT Advisory CA-2001-17 Check Point RDP Bypass Vulnerability
Original release date: July 09, 2001
Last revised: --
A complete revision history is at the end of this file.
* Check Point VPN-1 and FireWall-1 Version 4.1
A vulnerability in Check Point FireWall-1 and VPN-1 may allow an
intruder to pass traffic through the firewall on port 259/UDP.
Inside Security GmbH has discovered a vulnerability in Check Point
FireWall-1 and VPN-1 that allows an intruder to bypass the firewall.
The default FireWall-1 management rules allow arbitrary RDP (Reliable
Data Protocol) connections to traverse the firewall. RFC-908 and
RFC-1151 describe the Reliable Data Protocol (RDP). Quoting from
The Reliable Data Protocol (RDP) is designed to provide a reliable
data transport service for packet-based applications such as remote
loading and debugging.
RDP was designed to have much of the same functionality as TCP, but
has some advantages over TCP in certain situations. FireWall-1 and
VPN-1 include support for RDP, but they do not provide adequate
security controls. Quoting from the advisory provided by Inside
By adding a faked RDP header to normal UDP traffic any content can
be passed to port 259 on any remote host on either side of the
For more information, see the Inside Security GmbH security advisory,
Although the CERT/CC has not seen any incident activity related to
this vulnerability, we do recommend that all affected sites upgrade
their Check Point software as soon as possible.
An intruder can pass UDP traffic with arbitrary content through the
firewall on port 259 in violation of implied security policies.
If an intruder can gain control of a host inside the firewall, he may
be able to use this vulnerability to tunnel arbitrary traffic across
the firewall boundary.
Additionally, even if an intruder does not have control of a host
inside the firewall, he may be able to use this vulnerability as a
means of exploiting another vulnerability in software listening
passively on the internal network.
Finally, an intruder may be able to use this vulnerability to launch
certain kinds of denial-of-service attacks.
Install a patch from Check Point Software Technologies. More
information is available in Appendix A.
Until a patch can be applied, you may be able to reduce your exposure
to this vulnerability by configuring your router to block access to
259/UDP at your network perimeter.
Check Point has issued an alert for this vulnerability at
Download the patch from Check Point's web site:
Appendix B. - References
Our thanks to Inside Security GmbH for the information contained in
This document was written by Ian A. Finlay. If you have feedback
concerning this document, please send email to:
mailto:cert at cert.org?Subject=Feedback CA-2001-17 [VU#310295]
Copyright 2001 Carnegie Mellon University.
July 09, 2001: Initial Release
-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 5.0i for non-commercial use
-----END PGP SIGNATURE-----
VPN is sponsored by SecurityFocus.com
More information about the VPN