----------------------------------------------------------------------

Secunia is proud to announce the availability of the Secunia Software
Inspector.

The Secunia Software Inspector is a free service that detects insecure
versions of software that you may have installed in your system. When
insecure versions are detected, the Secunia Software Inspector also
provides thorough guidelines for updating the software to the latest
secure version from the vendor.

Try it out online:
http://secunia.com/software_inspector/

----------------------------------------------------------------------

TITLE:
Check Point Products ICS Security Bypass

SECUNIA ADVISORY ID:
SA23847

VERIFY ADVISORY:
http://secunia.com/advisories/23847/

CRITICAL:
Less critical

IMPACT:
Security Bypass

WHERE:
>From remote

OPERATING SYSTEM:
Check Point Connectra Appliances
http://secunia.com/product/13352/

SOFTWARE:

http://secunia.com/product//
Check Point VPN-1 Power NGX
http://secunia.com/product/13348/

http://secunia.com/product//
Check Point VPN-1 UTM NG AI
http://secunia.com/product/13350/
Check Point VPN-1 Power NG AI
http://secunia.com/product/13351/
Check Point VPN-1 UTM NGX
http://secunia.com/product/13346/

DESCRIPTION:
Roni Bachar and Nir Goldshlager have reported a vulnerability in
Check Point products, which can be exploited by malicious people to
bypass certain security restrictions.

The problem is that /sre/params.php in ICS (Integrity Clientless
Security) does not properly validate the data being sent to it. This
can be exploited to receive a cookie, which can be used to bypass
certain checks before being allowed to log in to the network, by
sending a POST request with a valid report to the /sre/params.php
page.

Successful exploitation requires that the ICS feature is enabled.

The vulnerability affects the following products and versions:
* Connectra NGX R62
* Connectra NGX R61
* Connectra NGX R60
* Connectra 2.0
* VPN-1 Power/UTM (Pro/Express) NGX R62
* VPN-1 Power/UTM (Pro/Express) NGX R61
* VPN-1 Power/UTM (Pro/Express) NGX R60
* VPN-1 Power/UTM (Pro/Express) NG AI R55W
* VPN-1 Power/UTM (Pro/Express) NG AI R55

SOLUTION:
Apply hotfix.

Connectra:
http://www.checkpoint.com/downloads/latest/hfa/connectra/index.html

VPN-1:
http://www.checkpoint.com/downloads/latest/hfa/vpn1_security/index.html

PROVIDED AND/OR DISCOVERED BY:
Roni Bachar and Nir Goldshlager, Avnet

ORIGINAL ADVISORY:
Check Point:
https://secureknowledge.checkpoint.com/SecureKnowledge/viewSolutionDocument.do?lid=sk32472

Full-Disclosure:
http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051920.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------