Bugtraq mailing list archives
Re: CheckPoint FW1 BUG
From: ipfreely () NEWHACKCITY NET (NHC Research)
Date: Thu, 13 Jul 2000 17:01:38 -0700
While doing some testing on Firewall-1 4.0 NT SP4 a few months ago, we came across a similar situation. We felt it was not worthy of an advisory because it is effectively a misconfiguration issue, although it is the default configuration upon initial install. Scenario: One firewall machine, 2 NICs (one for untrusted net, one for trusted net). Configuration: NT 4.0 SP6a Firewall-1 NT 4.0 SP4 Steps 2 Repro: 1. Install FW-1, define one subnet for each physical NIC. 2. From either network, send a SYN packet to the IP of the firewall, port 1032. ('telnet firewallip 1032', or 'nmap -sS -p 1032 firewallip') Result: One of the running instances of the fw.exe service goes to 100%. Why is this not a bug? Because the first thing the "wizard" does for you is to block all traffic directly to the firewall, this should not be an issue for most people. This is a really good thing, because FW-1 listens on an obscene number of ports in a default installation. If anyone can retest against FW-1 4.1 SP1, I'd be interested to see if this minor problem still exists. Does anyone have an official contact for Checkpoint to report security related issues?
Current thread:
- Re: CheckPoint FW1 BUG NHC Research (Jul 13)
- Re: CheckPoint FW1 BUG Hugo.van.der.Kooij () CAIW NL (Jul 14)
- Re: CheckPoint FW1 BUG uh Clem (Jul 14)
- Re: CheckPoint FW1 BUG Hugo.van.der.Kooij () CAIW NL (Jul 14)
- Re: CheckPoint FW1 BUG Jon Paul, Nollmann (Jul 17)
- Re: CheckPoint FW1 BUG Benjamin Smee (Jul 19)
- HP Jetdirect - Invalid FTP Command DoS Peter Grundl (Jul 19)
- Re: CheckPoint FW1 BUG Per Hoff (Jul 19)
- Alert: Buffer Overrun is O'Reilly WebsitePro httpd32.exe (CISADV000717) Cerberus Security Team (Jul 19)
- Alert: Buffer Overrun is O'Reilly WebsitePro webfind.exe (CISADV000718) Cerberus Security Team (Jul 19)
- Outlook exploit fix opens old hole? Ben (Jul 19)
- Re: CheckPoint FW1 BUG uh Clem (Jul 14)
- Re: CheckPoint FW1 BUG Hugo.van.der.Kooij () CAIW NL (Jul 14)