Checkpoint Firewall-1 vulnerability announced

SECURITY TESTING COMPANY NTA MONITOR has today issued a vulnerability warning for the Checkpoint Firewall-1 system - Checkpoint Firewall-1 VPNs are apparently visible to external hackers, which makes it possible for attackers to identify the firewall type and version number.

A fingerprinting technique, developed by NTA Monitor and dubbed IKE Vendor ID fingerprinting, allows the specific version of Firewall-1 to be identified. NTA reckons that the security issue affects all of the Checkpoint Firewall-1 products that are running IPsec VPN - currently there is no vendor fix, disabling IPsec is the only known workaround so far.

Roy Hills, technical director at NTA Monitor says "VPNs have been assumed to be an invisible and secure method of communication between a server and a remote connection. But such thinking is naïve."

Hills also said network admins need to check that they are aware of VPNs configured within their network, and must make sure they're using the latest security releases. µ

L'INQ
IKE Scan tool
Detailed vulnerability information