This issue was discovered by CodeGreen Systems Security Analyst and Principal Consulting Engineer Raeez Abdulla during a SSL VPN penetration testing engagement with one of our BFSI customers. If an administrator configured such an application with environment variables in the path, Portal Agent may run an arbitrary application that was placed in a specially created location. ‘Mobile Access Portal Agent’ runs predefined Native Applications. In Check Point SSL VPN, when environment variables are used in configuration before build 800007042, ‘Mobile Access Portal Agent’ arbitrary applications from a specially crafted location instead of the predefined Native Application.
0 kommentar(er)
