1.G to the Gateways & Services -> Edit SGCM Gateway. Initial disclosure to Check Point Security Incident Response Team via email. Now we will move to the IP SSL configuration in the Checkpoint firewall. Issue discovered by Raeez Abdulla, Security Analyst and Principal Consulting Engineer, CodeGreen Systems Wed, : Hotfix Name: Check_Point_ESOD_CSHELL_AUTOUPDATE_Bundle_T17_AutoUpdate.tar Here is the ink If automatic updates are enabled (see sk94508), the update will be installed automatically on all relevant Check Point machines. Users should install a hotfix to upgrade Portal Agent to a non-vulnerable version. ‍Check Point acknowledgement to CodeGreen can be found ‍ Here in this link It is being disclosed in accordance with industry best practices vulnerability disclosure policy and in cooperation with the Checkpoint Security Incident Response Team.įull PoC document can be downloaded from here Check Point's KB article can be found ‍ Here in this link ‍ This issue was discovered by CodeGreen Systems Security Analyst and Principal Consulting Engineer Raeez Abdulla during a SSL VPN penetration testing engagement with one of our BFSI customers. If an administrator configured such an application with environment variables in the path, Portal Agent may run an arbitrary application that was placed in a specially created location. Go to General Properties > Topology and manually add Google cloud IP addresses. Configure the IP address associated with Cloud VPN peer (external IP). Open SmartConsole > New > More > Network Object > More > Interoperable Device.

‘Mobile Access Portal Agent’ runs predefined Native Applications. To create an Interoperable Device for Cloud VPN on the Check Point SmartConsole: Step 1. In Check Point SSL VPN, when environment variables are used in configuration before build 800007042, ‘Mobile Access Portal Agent’ arbitrary applications from a specially crafted location instead of the predefined Native Application.

Checkpoint ssl vpn configuration