TITLE:
Check Point VPN-1 SecureClient Secure Configuration Verification
Bypass Weakness

SECUNIA ADVISORY ID:
SA17837

VERIFY ADVISORY:
http://secunia.com/advisories/17837/

CRITICAL:
Not critical

IMPACT:
Security Bypass

WHERE:
Local system

SOFTWARE:
Check Point VPN-1 SecureClient
http://secunia.com/product/2966/

DESCRIPTION:
Viktor Steinmann has reported a weakness in Check Point VPN-1
SecureClient, which potentially can be exploited by malicious users
to bypass certain security restrictions.

The weakness is caused due to SecureClient relying on the local copy
of the "local.scv" file downloaded from the policy server to perform
client integrity checks before allowing the client to connect to the
internal networks via VPN. This check may be bypassed by users with
write-access to the file by continuously replacing it with a modified
copy.

This weakness can potentially allow the SCV (Secure Configuration
Verification) feature of the product to be bypassed, which allow
client systems that are not compliant to the organisation's security
policies to connect to the internal networks.

SOLUTION:
Do not rely on the SCV as the only means of ensuring that client
systems are configured according to the security policy.

PROVIDED AND/OR DISCOVERED BY:
Viktor Steinmann

ORIGINAL ADVISORY:
http://lists.grok.org.uk/pipermail/full-disclosure/2005-December/039634.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------