exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Check Point Endpoint Security Server Information Disclosure

Check Point Endpoint Security Server Information Disclosure
Posted Feb 7, 2011
Authored by H D Moore, Rapid7 | Site rapid7.com

Rapid7 Security Advisory - The Check Point Endpoint Security Server and Integrity Server products inadvertently expose a number of private directories through the web interface. These directories include the SSL private keys, sensitive configuration files (often containing passwords), and application binaries.

tags | exploit, web
SHA-256 | 20ca3fdc39b73e2548b7489b74f418527c50c20cd49f5f2936862c36d8309547

Check Point Endpoint Security Server Information Disclosure

Change Mirror Download
R7-0038: Check Point Endpoint Security Server Information Disclosure
February 7, 2011

-- Vulnerability Details:

The Check Point Endpoint Security Server and Integrity Server products
inadvertently expose a number of private directories through the web
interface. These directories include the SSL private keys, sensitive
configuration files (often containing passwords), and application binaries.

Examples of exposed files include:

https://server/conf/ssl/apache/integrity-smartcenter.cert
https://server/conf/ssl/apache/integrity-smartcenter.key
https://server/conf/ssl/apache/integrity.cert
https://server/conf/ssl/apache/integrity.key
https://server/conf/ssl/apache/smartcenter.cert
https://server/conf/ssl/integrity-keystore.jks
https://server/conf/ssl/isskeys.jks
https://server/conf/ssl/openssl.pem
https://server/conf/integrity.xml
https://server/conf/jaas/users.xml

https://server/bin/DBSeed.xml

These files are also exposed via the Tomcat server:

http://server:8080/conf/ssl/apache/integrity-smartcenter.cert



-- Vendor Response:
Check Point has issued a hotfix for Endpoint Security Server versions
R71, R72 and R73 and Integrity Server version 7.

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk57881

This patch blocks remote access to the Tomcat instance (8080) and
restricts access to private directories via POST and GET requests. This
patch does not prevent a remote attacker from determining the size of a
sensitive file by using HEAD requests.


-- Disclosure Timeline:
2010-11-08 - Vulnerability reported to Check Point
2010-11-09 - Acknowledgement from Check Point
2010-11-29 - Advisory and hotfix released by Check Point
2011-01-19 - Remote check published for Rapid7 NeXpose
2011-02-07 - Detailed advisory released by Rapid7


-- Credit:
This vulnerability was discovered by HD Moore

-- About Rapid7 Security
Rapid7 provides vulnerability management, compliance and penetration
testing solutions for Web application, network and database security. In
addition to developing the NeXpose Vulnerability Management system,
Rapid7 manages the Metasploit Project and is the primary sponsor of the
W3AF web assessment tool.

Our vulnerability disclosure policy is available online at:

http://www.rapid7.com/disclosure.jsp




Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close