Technical Description

Multiple vulnerabilities have been identified in Ingate Firewall and SIParator, which could be exploited by remote attackers to disclose sensitive information, bypass authentication, cause a denial of service and potentially take complete control of an affected system.

The first issue is caused by an error in OpenSSL. For additional information, see : VUPEN/ADV-2006-3820

The second vulnerability is caused by missing permission checks when downloading Support Reports, which could be exploited by unprivileged attackers to gain knowledge of sensitive information.

The third issue is caused by an input validation error within the SIP authentication when processing the "maddr" parameter, which could be exploited by attackers to bypass the authentication process.

Affected Products

Ingate Firewall version 4.5.1 and prior
Ingate SIParator version 4.5.1 and prior

Solution

Upgrade to version 4.5.2 :
http://www.ingate.com/upgrades

References

http://www.vupen.com/english/advisories/2007/1973
http://www.ingate.com/relnote-452.php

Credits

Vulnerabilities reported by the vendor

ChangeLog

2007-05-29 : Initial release

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time alerts when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.