Check Point Firewall-1 Internal Address Leakage Vulnerability

A vulnerability exists in which Checkpoint Firewall-1 will expose internal addresses to machines outside the network. Under seemingly normal load conditions, according to the poster of this vulnerability, 40% CPU utilization with 200+ active connections, Firewall-1 will attempt to establish connections utilizing the internal address. As this address is either non-routable, or internal, a retransmission will occur; this packet will have the correct address rewritten, but will use the same source port. Using this information makes it easy to determine the firewall behind which this address resides, as well as the internal address of the machine being utilized to establish the connection being seen. This may be particularly useful to attackers conducting client side attacks.

These problems have been seen on both NT and Solaris versions of FW-1, although the poster indicated that not enough data was available to directly state the Solaris version was vulnerable in the same ways, or to the same degrees.


Privacy Statement
Copyright 2010, SecurityFocus