Description
Check Point Firewall-1 session agent 3.0 through 4.1 generates different error messages for invalid user names versus invalid passwords, which allows remote attackers to determine valid usernames and guess a password via a brute force attack.
Affected products
- checkpoint / firewall-13.0 – 3.0
- checkpoint / firewall-14.0 – 4.0
- checkpoint / firewall-14.1 – 4.1
Exploits & proofs of concept
- exploit-dbCheck Point Software Firewall-1 3.0/1 4.0/1 4.1 - Session Agent Dictionary Attack (2)by Gregory Duchemin
- exploit-dbCheck Point Software Firewall-1 3.0/1 4.0/1 4.1 - Session Agent Dictionary Attack (1)by Nelson Brito
Updated 18m ago · 8 sources