A buffer overflow vulnerability exists in the Internet Security Association and Key Management Protocol (ISAKMP) implementation used in Check Point VPN-1, SecuRemote, and SecureClient products. An unauthenticated, remote attacker could execute arbitrary code with the privileges of the ISAKMP process, typically root or SYSTEM.
ISAKMP (RFC 2408) defines a framework for authentication, key management, and the negotiation of Security Associations (SAs). The Internet Key Exchange protocol (IKE, RFC 2049) operates within the framework of ISAKMP and uses parts of Oakley (RFC 2412) and SKEME to negotiate and provide cryptographic key exchange for ISAKMP SAs. ISAKMP/IKE is commonly used by IPSec-based virtual private networks (VPNs).
The ISAKMP implementation used in the Check Point VPN server (VPN-1) and clients (SecuRemote, SecureClient) does not adequately validate Certificate Request payloads. As a result, a specially crafted ISAKMP packet could overflow a static memory buffer, writing arbitrary data on the stack.
An attacker who is able to send a UDP packet to the ISAKMP service (500/udp) could execute arbitrary code with the privileges of the VPN process, typically root or SYSTEM. No authentication is required to exploit this vulnerability.
Check Point workarounds
This vulnerability was reported by Internet Security Systems (ISS).
This document was written by Art Manion.
|Date First Published:||2004-02-05|
|Date Last Updated:||2004-02-12 16:51 UTC|