News
Vigil@nce - Check Point Security Gateway VE: predefined SSH/SSL keys
November 2013 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker, who knows a SSH/SSL key, can access to Check Point
Security Gateway VE.
– Impacted products: CheckPoint Security Gateway
– Severity: 2/4
– Creation date: 29/10/2013
DESCRIPTION OF THE VULNERABILITY
The Check Point Security Gateway Virtual Edition (VE) VMWare OVF
product can be installed on VMware ESX.
It provides a SSH service, and a WebUI interface. However,
cryptographic keys are not reset during the installation, so all
systems have the same keys.
An attacker, who knows a SSH/SSL key, can therefore access to
Check Point Security Gateway VE.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/Check-Point-Security-Gateway-VE-predefined-SSH-SSL-keys-13664
