Unscored severity · published Dec 31, 2002
CVE-2002-1623
The design of the Internet Key Exchange (IKE) protocol, when using Aggressive Mode for shared secret authentication, does not encrypt initiator or responder identities during…
–
CVSS
48.6%
EPSS
No
On KEV
Description
The design of the Internet Key Exchange (IKE) protocol, when using Aggressive Mode for shared secret authentication, does not encrypt initiator or responder identities during negotiation, which may allow remote attackers to determine valid usernames by (1) monitoring responses before the password is supplied or (2) sniffing, as originally reported for FireWall-1 SecuRemote.
Exploitation
Is it being used?
Exploit prediction (EPSS)48.6% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VF
Vpn-1 Firewall-1 · Checkpoint
4.0; 4.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2002-1623
CVE.org
https://www.cve.org/CVERecord?id=CVE-2002-1623
lists.grok.org.uk
http://lists.grok.org.uk/pipermail/full-disclosure/2002-September/001223.html
marc.info
http://marc.info/?l=bugtraq&m=103124812629621&w=2
marc.info
http://marc.info/?l=bugtraq&m=103176164729351&w=2
www.checkpoint.com
http://www.checkpoint.com/techsupport/alerts/ike.html
US Government Resource
http://www.kb.cert.org/vuls/id/886601
www.nta-monitor.com
http://www.nta-monitor.com/news/checkpoint.htm
More from Vpn-1 Firewall-1
–
CVE-2008-1397
Check Point VPN-1 Power/UTM, with NGX R60 through R65 and NG AI R55 software, allows remote authenticated users to cause a denial of service (site-to-site VPN tunnel outage), and…