Secunia

Mark Dowd and Neel Mehta of ISS X-Force has discovered a vulnerability in Check Point VPN-1 Server and VPN clients, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to a boundary error in the ISAKMP processing during authentication. This can be exploited to cause a buffer overflow by sending packets with an extremely large "Certificate Request" payload, which may allow execution of arbitrary code with SYSTEM or root privileges.

The following products are reportedly affected:
* Check Point VPN-1 Server 4.1 up to and including SP6 with OpenSSL Hotfix
* Check Point SecuRemote/SecureClient 4.1 up to and including build 4200

Solution
According to the vendor, version 4.1 with SP6 is not affected. However, this contradicts information from ISS X-Force.
Further details available in Customer Area

Provided and/or discovered by
Mark Dowd and Neel Mehta, ISS X-Force.

Changelog
Further details available in Customer Area

Original Advisory
ISS X-Force:
http://xforce.iss.net/xforce/alerts/id/163

Check Point:
http://www.checkpoint.com/techsupport/alerts/41_isakmp.html

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area