Comments on: Checkpoint Firewall 1 Exploits Discovered http://www.liquidmatrix.org/blog/2007/10/03/checkpoint-firewall-1-exploits-discovered/ Bringing Fire To The Village: Your Source For Computer, Network & Information Security News from Dave Lewis, Security Blogger Fri, 05 Dec 2008 09:36:28 +0000 http://wordpress.org/?v=2.6.5 By: Dave Lewis http://www.liquidmatrix.org/blog/2007/10/03/checkpoint-firewall-1-exploits-discovered/#comment-56638 Dave Lewis Thu, 04 Oct 2007 01:50:59 +0000 http://www.liquidmatrix.org/blog/2007/10/03/checkpoint-firewall-1-exploits-discovered/#comment-56638 @Gilbert Thanks for the link. @Gilbert

Thanks for the link.

]]> By: Dave Lewis http://www.liquidmatrix.org/blog/2007/10/03/checkpoint-firewall-1-exploits-discovered/#comment-56637 Dave Lewis Thu, 04 Oct 2007 01:50:12 +0000 http://www.liquidmatrix.org/blog/2007/10/03/checkpoint-firewall-1-exploits-discovered/#comment-56637 @ Chris Yes, that was a rhetorical question. The certification aspect of the story is not the part I have an issue with (for the most part). Where I get confused is how did this exploit not come to light previously? Checkpoint has the largest install base in the market today. R60 has been out for sometime now (as you rightly point out) and I would hazard that at least one pen tester has taken a run at it during that time. This isn't me beating on Checkpoint. I actually like their firewalls as well as several other vendors. If this exploit was a generic as I am to understand then it begs the question why we're only hearing about this now. And yes, no vendor is immune. If they were, wait 5 minutes. :D Thanks for your comment. cheers. @ Chris

Yes, that was a rhetorical question. The certification aspect of the story is not the part I have an issue with (for the most part). Where I get confused is how did this exploit not come to light previously? Checkpoint has the largest install base in the market today. R60 has been out for sometime now (as you rightly point out) and I would hazard that at least one pen tester has taken a run at it during that time. This isn’t me beating on Checkpoint. I actually like their firewalls as well as several other vendors. If this exploit was a generic as I am to understand then it begs the question why we’re only hearing about this now.

And yes, no vendor is immune. If they were, wait 5 minutes.

:D

Thanks for your comment.
cheers.

]]> By: Christofer Hoff http://www.liquidmatrix.org/blog/2007/10/03/checkpoint-firewall-1-exploits-discovered/#comment-56627 Christofer Hoff Thu, 04 Oct 2007 01:15:00 +0000 http://www.liquidmatrix.org/blog/2007/10/03/checkpoint-firewall-1-exploits-discovered/#comment-56627 I'm going to assume that your question was really rhetorical. However, in the spirit of stating the obvious, I will ask you a question. Have you ever submitted a product for CC/EAL "certification?" You know you pay third party contractors to provide this service, right? The testing performed by these vendors gets rid of the low hanging fruit; they exercise their judgment on how they evaluate the statements of fact made regarding how and what the vendor does to prove the system is "secure." They don't (and can't) test all of it. Think of it as an audit checklist. Those couple of statements ought to have answered your questions.... While I'm not defending Check Point or their apparent handling of the situation (which is only one man's opinion, mind you) these locally-exploitable vulnerabilities reach back to R60. They are shipping R65. It will be interesting to know whether the same sorts of attacks are relevant in R65 since R60 is about 2 years old. LOTS of changes since 2005... Ah well. Another vendor, another vuln. Not really surprising, is it? Happens to Cisco all the time, CHKP's no different. /Hoff I’m going to assume that your question was really rhetorical. However, in the spirit of
stating the obvious, I will ask you a question.

Have you ever submitted a product for CC/EAL “certification?” You know you pay third
party contractors to provide this service, right?

The testing performed by these vendors gets rid of the low hanging fruit; they exercise
their judgment on how they evaluate the statements of fact made regarding how and
what the vendor does to prove the system is “secure.” They don’t (and can’t) test all of
it.

Think of it as an audit checklist.

Those couple of statements ought to have answered your questions….

While I’m not defending Check Point or their apparent handling of the situation (which
is only one man’s opinion, mind you) these locally-exploitable vulnerabilities reach back
to R60. They are shipping R65.

It will be interesting to know whether the same sorts of attacks are relevant in R65 since R60 is about 2 years old. LOTS of changes since 2005…

Ah well. Another vendor, another vuln. Not really surprising, is it?

Happens to Cisco all the time, CHKP’s no different.

/Hoff

]]> By: Gilbert Verdian http://www.liquidmatrix.org/blog/2007/10/03/checkpoint-firewall-1-exploits-discovered/#comment-56624 Gilbert Verdian Thu, 04 Oct 2007 00:43:26 +0000 http://www.liquidmatrix.org/blog/2007/10/03/checkpoint-firewall-1-exploits-discovered/#comment-56624 Dave, Here is the paper which explains all http://packetstormsecurity.org/papers/attack/checkpoint_hack.pdf Found it very thorough, detailed and a great read. Dave,
Here is the paper which explains all
http://packetstormsecurity.org/papers/attack/checkpoint_hack.pdf

Found it very thorough, detailed and a great read.

]]> By: Alex http://www.liquidmatrix.org/blog/2007/10/03/checkpoint-firewall-1-exploits-discovered/#comment-56610 Alex Wed, 03 Oct 2007 19:09:30 +0000 http://www.liquidmatrix.org/blog/2007/10/03/checkpoint-firewall-1-exploits-discovered/#comment-56610 "How did this go undiscovered until now?" Great question! “How did this go undiscovered until now?”

Great question!

]]>