CVE-1999-1204: High severity checkpoint firewall-1 vulnerability
Check Point Firewall-1 does not properly handle certain restricted keywords (e.g., Mail, auth, time) in user-defined objects, which could produce a rule with a default "ANY" address and result in access to more systems than intended by the administrator.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Rename or avoid using restricted keywords in user-defined objects (such as 'Mail', 'auth', 'time') so the firewall does not generate rules with a default 'ANY' address.
Check Point FireWall-1 user-defined object names / keywords = do not use restricted keywords (e.g., Mail, auth, time) - Operational
Audit the firewall rulebase for rules referencing user-defined objects that contain restricted keywords; identify any rules that show a default 'ANY' address and correct them by updating, renaming, or recreating the affected objects with explicit addresses.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1204?
CVE-1999-1204 is a high-severity vulnerability that can lead to unauthorized access to systems behind the firewall.
How do I fix CVE-1999-1204?
To fix CVE-1999-1204, ensure that restricted keywords are not used in user-defined objects and review your firewall rules for unintended 'ANY' addresses.
What software is affected by CVE-1999-1204?
CVE-1999-1204 affects Check Point FireWall-1 across various versions.
What can happen if CVE-1999-1204 is exploited?
If CVE-1999-1204 is exploited, it may grant unauthorized access to additional systems, compromising network security.
How can I prevent vulnerabilities like CVE-1999-1204 in my firewall configuration?
To prevent vulnerabilities like CVE-1999-1204, regularly audit firewall rules and enforce strict object definitions to avoid default permissions.