CheckPoint FireWall-1 Security Breach

As mentioned at heise-newsticker, a specialized security team of ISS (X-Force) discovered two major flaws in FireWall-1 from Checkpoint. The first issue regards a format string handling error, and the second concerns the VPN-products, including the VPN-gateway and the SecuRemote/Secure-clients. The firewall is vulnerable because of a boundary error in the isakmp processing, when FireWall-1 tries to authenticate a user. Sending an extremely large "certificate request" message could be used to execute arbitrary code with the privileges of the isakmp-process, namely root or SYSTEM.