Check Point has plugged a serious security vulnerability affecting several versions of its flagship security platform, Firewall-1.

The problem stems from a flaw in the Application Intelligence (AI) component of Firewall-1, which is meant to detect application level attacks, but is itself vulnerable to format string or heap buffer overflow attacks.

Earlier versions of Firewall-1 include the HTTP Security Server, which provides similar functionality, are similarly vulnerable.

Flaws in Firewall-1 are uncommon are this one is far worse than most because it strikes at commonly deployed subsets of Check Point's technology not problems with in obscure configurations or settings.

Various versions of Check Point Firewall-1 NG and Check Point Firewall-1 NG with Application Intelligence are affected by the problem, which could be exploited to launch DoS attacks on the affected firewalls. Worse still the vulnerability could be used by a skilled attacker to run arbitrary code and thereby to take control of the firewall and the server it runs on.

An advisory by US-CERT explains the issue in greater depth. The problem was discovered by researchers at security tools vendor ISS

Check Point has released an advisory here. ®