February 2004 Archives

An interesting article, published anonymously, dissects the Transmeta TMS5xxx architecture, revealing how to access and modify the code-morphing code, how the instruction set works, and tells why you won't be able to run Linux directly on this chip. Neat.

As mentioned at heise-newsticker, a specialized security team of ISS (X-Force) discovered two major flaws in FireWall-1 from Checkpoint. The first issue regards a format string handling error, and the second concerns the VPN-products, including the VPN-gateway and the SecuRemote/Secure-clients. The firewall is vulnerable because of a boundary error in the isakmp processing, when FireWall-1 tries to authenticate a user. Sending an extremely large "certificate request" message could be used to execute arbitrary code with the privileges of the isakmp-process, namely root or SYSTEM.