Check Point FireWall-1/VPN-1 Contains H.323 Processing Vulnerabilities With Unspecified Impact
|
|
SecurityTracker Alert ID: 1008846
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Jan 26 2004
|
Impact: Denial of service via network, Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): NG
|
Description: A vulnerability was reported in Check Point FireWall-1/VPN-1 in the processing of H.323 messages. The impact was not disclosed.
It was reported that Check Point FireWall-1 and VPN-1 products are vulnerable to the H.323 security tests recently conducted by NISCC
[http://www.uniras.gov.uk/vuls/2004/006489/h323.htm] based on the University of Oulu Security Programming Group (OUSPG) test suite.
Check
Point did not provide any details regarding the specific impact on the products.
The report indicates that VPN-1 parses H.323
messages by default but FireWall-1 does not.
|
Impact: The impact was not disclosed.
[Editor's note: We believe it unlikely that the vendor does not know the true extent of the vulnerability,
so we are requesting additional information. NISCC has found that some products may crash and some products may execute arbitrary
code when subjected to the OUSPG H.323 test suite. As a result, we have categorized this as a potential denial of service and potential
remote code execution flaw until we receive clarification from the vendor.]
|
Solution: Check Point has recommended that all customers should obtain an H.323 update, available at:
http://www.checkpoint.com/techsupport/h323_hf.html
|
Vendor URL: www.checkpoint.com/techsupport/alerts/h323.html (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Linux (Any), UNIX (AIX), UNIX (HP/UX), UNIX (Solaris - SunOS), Windows (NT), Windows (2000)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Mon, 26 Jan 2004 10:26:21 -0500
Subject: http://www.checkpoint.com/techsupport/alerts/h323.html
|
http://www.checkpoint.com/techsupport/alerts/h323.html
Check Point reported that FireWall-1 and VPN-1 products are affected by the recently
disclosed H.323 vulnerabilities. However, the vendor did not provide any details
regarding the specific impact on the products.
Check Point has recommended that all customers should obtain an H.323 update, available at:
http://www.checkpoint.com/techsupport/h323_hf.html
The vendor recommends that all customers update regardless of whether they are using H.323
or not.
The report indicates that VPN-1 parses H.323 messages by default but FireWall-1 does not.
|
|
