Checkpoint Firewall-1 vulnerabilities

CVE-2001-0182 [MEDIUM] CVE-2001-0182: FireWall-1 4.1 with a limited-IP license allows remote attackers to cause a denial of service by sen FireWall-1 4.1 with a limited-IP license allows remote attackers to cause a denial of service by sending a large number of spoofed IP packets with various source addresses to the inside interface, which floods the console with warning messages and consumes CPU resources.

CVE-2001-0082 [HIGH] CVE-2001-0082: Check Point VPN-1/FireWall-1 4.1 SP2 with Fastmode enabled allows remote attackers to bypass access Check Point VPN-1/FireWall-1 4.1 SP2 with Fastmode enabled allows remote attackers to bypass access restrictions via malformed, fragmented packets.

CVE-2000-1037 [HIGH] CVE-2000-1037: Check Point Firewall-1 session agent 3.0 through 4.1 generates different error messages for invalid Check Point Firewall-1 session agent 3.0 through 4.1 generates different error messages for invalid user names versus invalid passwords, which allows remote attackers to determine valid usernames and guess a password via a brute force attack.

CVE-2000-1032 [MEDIUM] CVE-2000-1032: The client authentication interface for Check Point Firewall-1 4.0 and earlier generates different e The client authentication interface for Check Point Firewall-1 4.0 and earlier generates different error messages for invalid usernames versus invalid passwords, which allows remote attackers to identify valid usernames on the firewall.

CVE-2000-0808 [HIGH] CVE-2000-0808: The seed generation mechanism in the inter-module S/Key authentication mechanism in Check Point VPN- The seed generation mechanism in the inter-module S/Key authentication mechanism in Check Point VPN-1/FireWall-1 4.1 and earlier allows remote attackers to bypass authentication via a brute force attack, aka "One-time (s/key) Password Authentication."

CVE-2000-0805 [HIGH] CVE-2000-0805: Check Point VPN-1/FireWall-1 4.1 and earlier improperly retransmits encapsulated FWS packets, even i Check Point VPN-1/FireWall-1 4.1 and earlier improperly retransmits encapsulated FWS packets, even if they do not come from a valid FWZ client, aka "Retransmission of Encapsulated Packets."

CVE-2000-0807 [HIGH] CVE-2000-0807: The OPSEC communications authentication mechanism (fwn1) in Check Point VPN-1/FireWall-1 4.1 and ear The OPSEC communications authentication mechanism (fwn1) in Check Point VPN-1/FireWall-1 4.1 and earlier allows remote attackers to spoof connections, aka the "OPSEC Authentication Vulnerability."

CVE-2000-0804 [HIGH] CVE-2000-0804: Check Point VPN-1/FireWall-1 4.1 and earlier allows remote attackers to bypass the directionality ch Check Point VPN-1/FireWall-1 4.1 and earlier allows remote attackers to bypass the directionality check via fragmented TCP connection requests or reopening closed TCP connection requests, aka "One-way Connection Enforcement Bypass."

CVE-2000-0809 [MEDIUM] CVE-2000-0809: Buffer overflow in Getkey in the protocol checker in the inter-module communication mechanism in Che Buffer overflow in Getkey in the protocol checker in the inter-module communication mechanism in Check Point VPN-1/FireWall-1 4.1 and earlier allows remote attackers to cause a denial of service.

CVE-2000-0806 [MEDIUM] CVE-2000-0806: The inter-module authentication mechanism (fwa1) in Check Point VPN-1/FireWall-1 4.1 and earlier may The inter-module authentication mechanism (fwa1) in Check Point VPN-1/FireWall-1 4.1 and earlier may allow remote attackers to conduct a denial of service, aka "Inter-module Communications Bypass."

CVE-2000-0813 [MEDIUM] CVE-2000-0813: Check Point VPN-1/FireWall-1 4.1 and earlier allows remote attackers to redirect FTP connections to Check Point VPN-1/FireWall-1 4.1 and earlier allows remote attackers to redirect FTP connections to other servers ("FTP Bounce") via invalid FTP commands that are processed improperly by FireWall-1, aka "FTP Connection Enforcement Bypass."

CVE-2000-0779 [HIGH] CVE-2000-0779: Checkpoint Firewall-1 with the RSH/REXEC setting enabled allows remote attackers to bypass access re Checkpoint Firewall-1 with the RSH/REXEC setting enabled allows remote attackers to bypass access restrictions and connect to a RSH/REXEC client via malformed connection requests.

CVE-2000-0582 [MEDIUM] CVE-2000-0582: Check Point FireWall-1 4.0 and 4.1 allows remote attackers to cause a denial of service by sending a Check Point FireWall-1 4.0 and 4.1 allows remote attackers to cause a denial of service by sending a stream of invalid commands (such as binary zeros) to the SMTP Security Server proxy.

CVE-2000-0482 [MEDIUM] CVE-2000-0482: Check Point Firewall-1 allows remote attackers to cause a denial of service by sending a large numbe Check Point Firewall-1 allows remote attackers to cause a denial of service by sending a large number of malformed fragmented IP packets.

CVE-2000-0181 [MEDIUM] CVE-2000-0181: Firewall-1 3.0 and 4.0 leaks packets with private IP address information, which could allow remote a Firewall-1 3.0 and 4.0 leaks packets with private IP address information, which could allow remote attackers to determine the real IP address of the host that is making the connection.

CVE-2000-0150 [HIGH] CVE-2000-0150: Check Point Firewall-1 allows remote attackers to bypass port access restrictions on an FTP server b Check Point Firewall-1 allows remote attackers to bypass port access restrictions on an FTP server by forcing it to send malicious packets that Firewall-1 misinterprets as a valid 227 response to a client's PASV attempt.

CVE-2000-0116 [HIGH] CVE-2000-0116: Firewall-1 does not properly filter script tags, which allows remote attackers to bypass the "Strip Firewall-1 does not properly filter script tags, which allows remote attackers to bypass the "Strip Script Tags" restriction by including an extra < in front of the SCRIPT tag.

CVE-1999-0895 [HIGH] CVE-1999-0895: Firewall-1 does not properly restrict access to LDAP attributes. Firewall-1 does not properly restrict access to LDAP attributes.

CVE-1999-0675 [MEDIUM] CVE-1999-0675: Check Point FireWall-1 can be subjected to a denial of service via UDP packets that are sent through Check Point FireWall-1 can be subjected to a denial of service via UDP packets that are sent through VPN-1 to port 0 of a host.

CVE-1999-0770 [LOW] CVE-1999-0770: Firewall-1 sets a long timeout for connections that begin with ACK or other packets except SYN, allo Firewall-1 sets a long timeout for connections that begin with ACK or other packets except SYN, allowing an attacker to conduct a denial of service via a large number of connection attempts to unresponsive systems.