Secunia

Mark Dowd of ISS X-Force has discovered multiple vulnerabilities in Check Point FireWall-1, which can be exploited by malicious people to compromise a vulnerable firewall.

The vulnerabilities are caused due to format string errors in the Application Intelligence component and the HTTP Security Server application proxy during parsing of HTTP traffic. This can be exploited to execute arbitrary code with SYSTEM or root privileges on a vulnerable firewall by sending specially crafted HTTP requests containing certain invalid data including format specifiers.

Successful exploitation requires that HTTP Application Intelligence or the HTTP Security Server is enabled.

The vulnerabilities have been reported in the following versions:
* Check Point Firewall-1 NG-AI R55, R54, including SSL hotfix.
* Check Point Firewall-1 HTTP Security Server included with NG FP1, FP2, FP3.
* Check Point Firewall-1 HTTP Security Server included with 4.1.

Solution
The vendor has issued a fix.
Further details available in Customer Area

Provided and/or discovered by
Mark Dowd, ISS X-Force.

Changelog
Further details available in Customer Area

Original Advisory
ISS X-Force:
http://xforce.iss.net/xforce/alerts/id/162

Check Point:
http://www.checkpoint.com/techsupport/alerts/security_server.html

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area