SAN CARLOS, CA--(Marketwired - Oct 21, 2014) - Check Point® Software Technologies Ltd. (
"Check Point shared its findings with the affected vendors as part of its duty for responsible disclosure of vulnerabilities," said Oded Vanunu, security research group manager at Check Point Software Technologies. "Check Point is committed to ensuring the security of all organizations. As such, we are obligated to raise awareness of the vulnerabilities that can affect Admin WebUI portals. We strongly recommend that organizations using WebUI check with their vendors to ensure that they are not exposed to the uncovered vulnerabilities."
The vulnerabilities were discovered using a combination of Cross-site Scripting (XSS), Cross-site Request Forgery (CSRF) and Phishing attacks. To mitigate the risk of Admin WebUI exploits, Check Point strongly recommends organizations using security products with a WebUI portal to implement the following best practices:
- Use a dedicated web browser to manage the WebUI of security devices. Do not use this browser to open and use links from incoming emails, no matter how plausible the email seems to be.
- Use a dedicated management network (physical or logical) that is separate from the users' Local Area Network (LAN).
- Use a dedicated server that is connected only to the security devices and has no connection to the public Internet. This dedicated server can be managed remotely via a terminal server or VPN connection using strong, two-factor authentication.
"The WebUI approach introduces multiple attack vectors and our research has shown 21 of 23 network security vendors use a WebUI to manage their product security configuration," concluded Vanunu.
Check Point's Malware and Security Research Groups regularly perform assessments of common security products to ensure the security of Internet users worldwide. For more information on other research and vulnerabilities findings from Check Point, visit: http://www.checkpoint.com/advisories/index.html
Follow Check Point via: Twitter: www.twitter.com/checkpointsw Facebook: https://www.facebook.com/checkpointsoftware YouTube: http://www.youtube.com/user/CPGlobal
About Check Point Software Technologies Ltd. Check Point Software Technologies Ltd. ( www.checkpoint.com ), the worldwide leader in securing the Internet, provides customers with uncompromised protection against all types of threats, reduces security complexity and lowers total cost of ownership. Check Point first pioneered the industry with FireWall-1 and its patented stateful inspection technology. Today, Check Point continues to develop new innovations based on the Software Blade Architecture, providing customers with flexible and simple solutions that can be fully customized to meet the exact security needs of any organization. Check Point is the only vendor to go beyond technology and define security as a business process. Check Point 3D Security uniquely combines policy, people and enforcement for greater protection of information assets and helps organizations implement a blueprint for security that aligns with business needs. Customers include tens of thousands of organizations of all sizes, including all Fortune and Global 100 companies. Check Point's award-winning ZoneAlarm solutions protect millions of consumers from hackers, spyware and identity theft.
