VAR-199910-0020

Vulnerability from variot - Updated: 2023-12-18 12:40

Firewall-1 does not properly restrict access to LDAP attributes. With FireWall-1 Version 4.0 Checkpoint introduced support for the Lightweight Directory Access Protocol (LDAP) for user authentication. It looks like there's a bug in Checkpoint's ldap code which under certain circumstances can lead to unauthorized access to protected systems behind the firewall. A user can authenticate himself at the firewall providing a valid username and password. The firewall acts as a ldap client, validating the credentials by a directory server using the ldap protocol. After successful authentication access will be granted to systems protected by the firewall. In contrast to authentication using the Radius or SecurID protocol, after successful authentication the directory server can supply the firewall with additional ldap attributes for the user like the time and day of a week a user is allowed to login, the source addresses a user can run a client from, or the system behind the firewall a user is allowed to access. This can be done individual for each user. In general I think that's a great idea but it seems Checkpoint made something wrong interpreting the ldap attribute 'fw1allowed-dst' which is supposed to control in detail which protected network object a user can access. It seems this attribute is ignored by the firewall software, granting access to all protected network objects instead. Example: ------ Server 'Foo' | Internet --- FW-1 ---| | ------ Server 'Bar' Supposed there's a user 'Sid' with access only to Server 'Foo', and a second user 'Nancy' with access restricted to Server 'Bar', both controlled by the ldap protocol, using the ldap attribute 'fw1allowed-dst'. The bug will cause that both, Sid and Nancy, will have access to Foo and to Bar. [Quoted from the post by Olaf Selke with permission]

Show details on source website
To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-199910-0020",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "firewall-1",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "checkpoint",
        "version": "4.0"
      },
      {
        "model": "point software firewall-1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "check",
        "version": "4.0"
      },
      {
        "model": "point software firewall-1",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "check",
        "version": "3.0"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "725"
      },
      {
        "db": "NVD",
        "id": "CVE-1999-0895"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-199910-033"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:checkpoint:firewall-1:4.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-1999-0895"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "This vulnerability was posted to the Bugtraq mailing list by Olaf Selke \u003colaf.selke@mediaways.net\u003e on Wed, 20 Oct 1999.",
    "sources": [
      {
        "db": "BID",
        "id": "725"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-199910-033"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-1999-0895",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": true,
            "severity": "HIGH",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "VHN-876",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-1999-0895",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-199910-033",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-876",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-876"
      },
      {
        "db": "NVD",
        "id": "CVE-1999-0895"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-199910-033"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Firewall-1 does not properly restrict access to LDAP attributes. With FireWall-1 Version 4.0 Checkpoint introduced support for the Lightweight Directory Access Protocol (LDAP) for user authentication. It looks like there\u0027s a bug in Checkpoint\u0027s ldap code which under certain circumstances can lead to unauthorized access to protected systems behind the firewall. \nA user can authenticate himself at the firewall providing a valid  username and password. The firewall acts as a ldap client, validating the credentials by a directory server using the ldap protocol. After successful authentication access will be granted to systems protected by the firewall. \nIn contrast to authentication using the Radius or SecurID protocol, after successful authentication the directory server can supply the  firewall with additional ldap attributes for the user like the time and day of a week a user is allowed to login, the source addresses  a user can run a client from, or the system behind the firewall a user is allowed to access. This can be done individual for each user. \nIn general I think that\u0027s a great idea but it seems Checkpoint made something wrong interpreting the ldap attribute \u0027fw1allowed-dst\u0027 which is supposed to control in detail which protected network object a user can access. \nIt seems this attribute is ignored by the firewall software, granting access to all protected network objects instead. \nExample:\n------ Server \u0027Foo\u0027\n|\nInternet --- FW-1 ---|\n|\n------ Server \u0027Bar\u0027\nSupposed there\u0027s a user \u0027Sid\u0027 with access only to Server \u0027Foo\u0027, and  a second user \u0027Nancy\u0027 with access restricted to Server \u0027Bar\u0027, both  controlled by the ldap protocol, using the ldap attribute \u0027fw1allowed-dst\u0027. The bug will cause that both, Sid and Nancy, will  have access to Foo and to Bar. \n[Quoted from the post by Olaf Selke with permission]",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-1999-0895"
      },
      {
        "db": "BID",
        "id": "725"
      },
      {
        "db": "VULHUB",
        "id": "VHN-876"
      }
    ],
    "trust": 1.26
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "725",
        "trust": 2.0
      },
      {
        "db": "NVD",
        "id": "CVE-1999-0895",
        "trust": 1.7
      },
      {
        "db": "OSVDB",
        "id": "1117",
        "trust": 1.7
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-199910-033",
        "trust": 0.7
      },
      {
        "db": "BUGTRAQ",
        "id": "19991020 CHECKPOINT FIREWALL-1 V4.0: POSSIBLE BUG IN LDAP AUTHENTICATION",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-876",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-876"
      },
      {
        "db": "BID",
        "id": "725"
      },
      {
        "db": "NVD",
        "id": "CVE-1999-0895"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-199910-033"
      }
    ]
  },
  "id": "VAR-199910-0020",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-876"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T12:40:49.088000Z",
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-Other",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-1999-0895"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.7,
        "url": "http://www.securityfocus.com/bid/725"
      },
      {
        "trust": 1.7,
        "url": "http://www.osvdb.org/1117"
      },
      {
        "trust": 1.0,
        "url": "http://www.securityfocus.com/templates/archive.pike?list=1\u0026msg=19991020150002.21047.qmail%40tarjan.mediaways.net"
      },
      {
        "trust": 0.7,
        "url": "http://www.securityfocus.com/templates/archive.pike?list=1\u0026msg=19991020150002.21047.qmail@tarjan.mediaways.net"
      },
      {
        "trust": 0.3,
        "url": "http://www.checkpoint.com/techsupport/"
      },
      {
        "trust": 0.3,
        "url": "http://www.enteract.com/~lspitz/fwtable.html"
      },
      {
        "trust": 0.1,
        "url": ""
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-876"
      },
      {
        "db": "BID",
        "id": "725"
      },
      {
        "db": "NVD",
        "id": "CVE-1999-0895"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-199910-033"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-876"
      },
      {
        "db": "BID",
        "id": "725"
      },
      {
        "db": "NVD",
        "id": "CVE-1999-0895"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-199910-033"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "1999-10-20T00:00:00",
        "db": "VULHUB",
        "id": "VHN-876"
      },
      {
        "date": "1999-10-20T00:00:00",
        "db": "BID",
        "id": "725"
      },
      {
        "date": "1999-10-20T04:00:00",
        "db": "NVD",
        "id": "CVE-1999-0895"
      },
      {
        "date": "1999-10-20T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-199910-033"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2008-09-09T00:00:00",
        "db": "VULHUB",
        "id": "VHN-876"
      },
      {
        "date": "1999-10-20T00:00:00",
        "db": "BID",
        "id": "725"
      },
      {
        "date": "2023-11-07T01:55:04.473000",
        "db": "NVD",
        "id": "CVE-1999-0895"
      },
      {
        "date": "2006-01-04T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-199910-033"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-199910-033"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Check Point Firewall - 1 LDAP Verification vulnerability",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-199910-033"
      }
    ],
    "trust": 0.6
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "access verification error",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-199910-033"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.