By John Leyden, VNU Net
Check Point Software has admitted that an as yet unfixed flaw in
its market leading firewall product, Firewall-1, leaves it
vulnerable to denial of service attacks.
During routine security tests, Lance Spitzner, a member of the
Global Enterprise Security Team at Sun Microsystems, discovered
that the firewall can be brought down by exploiting the very
mechanisms designed to log problems.
Because of a flaw in its fragmentation logging process, Spitzner
discovered a Firewall-1 gateway can be disabled by bombarding it
with a stream of incomplete fragments of data packets, using a tool
called jolt2.
In a statement on its website, Check Point admitted: “A stream
of large IP fragments can cause the Firewall-1 code that logs the
fragmentation event to consume most available host system CPU
cycles.”
Because system resources become consumed with this logging, the
normal functions of firewall cannot be accomplished, leading to a
denial of service.
Check Point sought to play down the problem, saying that it does
not allow a cracker to break into protected networks and that no
real-world exploits had been reported by customers. Nonetheless,
the flaw is acutely embarrassing for the security vendor.
Deri Jones, managing director of security tester NTA Monitor,
said: “It is slightly embarrassing to Check Point that their log
processes can overflow the system resources in this way. However,
firewall flaws occur on an infrequent but regular basis.”
Jones described the problem as “nasty” and another example of a
wider problem that has been exercising security administrators of
late.
“In the last month or so, a number of products have been found
to have problems with fragmented packet attacks – I guess as a
result of some new types of IP packet fragment profiles being bench
tested against products,” said Jones.
Check Point has advised users to disable console logging until
it develops a long-term fix, which will be available with the next
service pack of affected releases of Firewall-1, including versions
4.0 and 4.1.