Summaryinfo

A vulnerability was found in Check Point Security Gateway R75.47 and classified as critical. Affected is an unknown function of the component Route Change Handler. Such manipulation leads to security check. Furthermore, there is an exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Check Point Security Gateway R75.47. Affected by this issue is an unknown code of the component Route Change Handler. The manipulation with an unknown input leads to a security check vulnerability. Using CWE to declare the problem leads to CWE-358. The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique. Impacted is confidentiality, integrity, and availability. The advisory summarizes:

This issue affects only R75.47 Security Gateway and R75.47 Management Server.

The weakness was shared 01/14/2014 as sk98087 as confirmed advisory (Website). The advisory is shared for download at supportcenter.checkpoint.com. The exploitation is known to be difficult. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1211. The advisory points out:

Anti-Spoofing might be enforced incorrectly on R75.47 Security Gateway after the following operations: Change routing table on the Security Gateway (e.g., add a static route). Perform the "Get - Interfaces with Topology" operation in Security Gateway object ('Topology' pane).

After immediately, there has been an exploit disclosed. It is declared as proof-of-concept.

Upgrading eliminates this vulnerability. The upgrade is hosted for download at supportcontent.checkpoint.com. A possible mitigation has been published immediately after the disclosure of the vulnerability. The advisory contains the following remark:

To solve this issue, install this improved SmartConsole.

The vulnerability is also documented in the vulnerability database at OSVDB (102392†). The entry VDB-12229 is related to this item. Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Check Point

Name

• Security Gateway

Version

• R75.47

License

• commercial

Website

• Vendor: https://www.checkpoint.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion