Underlying OS: Linux (Any), UNIX (macOS/OS X), UNIX (Solaris - SunOS), Windows (Any) Vendor URL: /SecureKnowledge/viewSolutionDocument.do?lid=sk32472 (Links to External Site) The Check Point advisories are available at:

The vendor has issued hotfixes for VPN-1. Roni Bachar and Nir Goldshlager discovered this vulnerability.Ī user can bypass the scanning function to potentially gain access to the network. The vendor was notified on December 24, 2006. The vulnerability resides in the optional Integrity Clientless Security (ICS) component, where a user can send a 'good' report to the '/sre/params.php' page to obtain a valid ICSCookie authentication value from the server which can then be used to bypass the endpoint security test results. Successful authentication is still required to connect to the network. A user can bypass the scanning function.Ī user can spoof valid scan results on a client system, allowing the client system to connect to the network as if a successful scan has occured when it has not. Version(s): R55, R55W, R60, R61, R62 ICS version3.x and priorĪ vulnerability was reported in Check Point VPN-1. Home | View Topics | Search | Contact Us |Ĭheck Point VPN-1 Integrity Clientless Security Lets Users Bypass the Scanning FunctionĬVE Reference: CVE-2007-0471 (Links to External Site)įix Available: Yes Vendor Confirmed: Yes Exploit Included: Yes Check Point VPN-1 Integrity Clientless Security Lets Users Bypass the Scanning Function - SecurityTracker

Checkpoint vpn client keep alive