CVE-2000-0150: High severity checkpoint firewall-1 vulnerability
Check Point Firewall-1 allows remote attackers to bypass port access restrictions on an FTP server by forcing it to send malicious packets that Firewall-1 misinterprets as a valid 227 response to a client's PASV attempt.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable Check Point's FTP application inspection or FTP helper so the firewall does not automatically open data ports based on interpreted 227 responses from the FTP server.
Check Point FireWall-1 FTP inspection / application helper = disabled - Configuration
Disable passive (PASV) mode on the FTP server to prevent reliance on 227 responses that the firewall may misinterpret.
FTP server passive_mode = disabled - Compensating control
Restrict access to the FTP server to trusted IP addresses or internal networks at the perimeter firewall to limit exposure while a permanent fix is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0150?
CVE-2000-0150 has a high severity rating due to the potential for unauthorized access to FTP services.
How do I fix CVE-2000-0150?
The recommended fix for CVE-2000-0150 is to apply the latest security patches provided by Check Point and Cisco for their respective firewall software.
What versions are affected by CVE-2000-0150?
CVE-2000-0150 affects Check Point FireWall-1 version 3.0 and 4.0, as well as specific versions of Cisco PIX Firewall 4.1(6), 4.1(6b), 4.2(1), 4.2(2), 4.3, and 4.4(4), and 5.0.
Can CVE-2000-0150 be exploited remotely?
Yes, CVE-2000-0150 can be exploited remotely by attackers to bypass FTP port access restrictions.
What is the nature of the vulnerability described in CVE-2000-0150?
CVE-2000-0150 involves the misinterpretation of malicious packets by Check Point FireWall-1, allowing unauthorized FTP access.