Firewall flaw threatens server shutdown

Check Point Software has admitted that an as yet unfixed flaw in its market leading firewall product, Firewall-1, leaves it vulnerable to denial of service attacks.

During routine security tests, Lance Spitzner, a member of the Global Enterprise Security Team at Sun Microsystems, discovered that the firewall can be brought down by exploiting the very mechanisms designed to log problems.

Because of a flaw in its fragmentation logging process, Spitzner discovered a Firewall-1 gateway can be disabled by bombarding it with a stream of incomplete fragments of data packets, using a tool called jolt2.

In a statement on its website, Check Point admitted: "A stream of large IP fragments can cause the Firewall-1 code that logs the fragmentation event to consume most available host system CPU cycles."

Because system resources become consumed with this logging, the normal functions of firewall cannot be accomplished, leading to a denial of service.

Check Point sought to play down the problem, saying that it does not allow a cracker to break into protected networks and that no real-world exploits had been reported by customers. Nonetheless, the flaw is acutely embarrassing for the security vendor.

Deri Jones, managing director of security tester NTA Monitor, said: "It is slightly embarrassing to Check Point that their log processes can overflow the system resources in this way. However, firewall flaws occur on an infrequent but regular basis."

Jones described the problem as "nasty" and another example of a wider problem that has been exercising security administrators of late.

"In the last month or so, a number of products have been found to have problems with fragmented packet attacks - I guess as a result of some new types of IP packet fragment profiles being bench tested against products," said Jones.

Check Point has advised users to disable console logging until it develops a long-term fix, which will be available with the next service pack of affected releases of Firewall-1, including versions 4.0 and 4.1.