Description
Check Point Endpoint Security MI Server through R73 3.0.0 HFA2.5 does not configure X.509 certificate validation for client devices, which allows man-in-the-middle attackers to spoof SSL servers by presenting an arbitrary certificate during a session established by a client.
References
- https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk97784
- 56744 third-party-advisory
- checkpoint-cve20137304-spoofing(90674) vdb-entry
- 65135 vdb-entry
- 1029704 vdb-entry