Description
Check Point VPN-1 SecureClient NG with Application Intelligence R56, NG FP1, 4.0, and 4.1 allows remote attackers to bypass security policies by modifying the local copy of the local.scv policy file after it has been downloaded from the VPN Endpoint.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Check Point VPN-1 SecureClient 4.0 < 4.1 - Policy Bypass EDB-26754 · dos · Dec 7, 2005 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 15757 vdb-entry
- 20051207 Checkpoint SecureClient NGX Security Policy can easily be disabled mailing-list
- http://www.mail-archive.com/swinog%40lists.swinog.ch/msg00799.html
- DSA-1237 vendor-advisory
- 17837 third-party-advisory
- 1015326 vdb-entry
- http://www.mail-archive.com/swinog%40lists.swinog.ch/msg00798.html
- 23395 third-party-advisory
- ADV-2005-2808 vdb-entry