Whoa, I’m finding this an interesting read from Heise. Apparently there are some buffer overflows in Checkpoint Firewall 1. The testers in question didn’t even have to resort to the use of fuzzers. The version as tested was R60.
From Heise:
Spanish security specialists Pentest have published a vulnerability analysis of Checkpoint’s Firewall-1 flagship product, in which they express doubts about the certification of the vendor’s Secure Platform R60 according to Common Criteria EAL4+. Their analysis has revealed several buffer overflows in command line utilities, which, in their opinion, should not have passed a reliable development cycle. While the experts were only able to exploit the vulnerabilities locally, they do not exclude the possibility of remote exploitation for the purpose of compromising systems.
According to Pentest, they have not even used fuzzing tools for their tests, but have simply used manipulated arguments to cause a buffer overflow in the programs; this does not comply with the vendor’s description of the relevant target of evaluation (TOE), i.e. the platform to be evaluated.
So my question is a simple one. How did this go undiscovered until now?
Tags: Checkpoint Firewall 1, Buffer Overflow, Checkpoint Exploits
