CVE-1999-0675: Medium severity checkpoint firewall-1 vulnerability
Check Point FireWall-1 can be subjected to a denial of service via UDP packets that are sent through VPN-1 to port 0 of a host.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure FireWall-1 / VPN-1 to drop or reject UDP packets with destination port 0 and disable forwarding of UDP port 0 through VPN tunnels.
Check Point FireWall-1 (VPN-1) drop_udp_port_0 = true - Compensating control
Block or filter UDP packets with destination port 0 at perimeter firewalls and VPN gateways (apply ACLs/firewall rules to drop UDP dst port 0 for traffic traversing VPN-1).
- Operational
Monitor VPN and firewall logs for UDP traffic to destination port 0, investigate and temporarily block or isolate offending peers or hosts until a vendor fix is available and applied.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0675?
CVE-1999-0675 is classified as a denial of service vulnerability, which can disrupt service for users.
How do I fix CVE-1999-0675?
To remediate CVE-1999-0675, it is recommended to upgrade to the latest version of Check Point FireWall-1 that includes fixes for this vulnerability.
What versions of Check Point FireWall-1 are affected by CVE-1999-0675?
CVE-1999-0675 affects Check Point FireWall-1 versions 3.0 and 4.0.
What kind of attack does CVE-1999-0675 facilitate?
CVE-1999-0675 facilitates a denial of service attack via UDP packets directed to port 0.
Can CVE-1999-0675 be exploited remotely?
Yes, CVE-1999-0675 can be exploited remotely through the UDP packets sent to the affected port.