vulnerability

[umar7]

Hi,

The product that are affected are Security Gateway and Security Management.

As you can see on the screenshot, these are high ports and when there is a restart of services the port number no longer listening.

Even though it is listening, there is no way I can remotely access these ports.

Unfortunately I can’t share the entire report to you, but this is the screenshot of the va report from tenable and it is indicating some half-open port.

I just want to find out more on how can we reply with all these half-open ports.

both sms and sg os - R81.10 take 30

appliance 6900 security gateway and sms is vm ware 

kindly help with this case

[G_W_Albrecht]

Both ports are not listed here: sk52421: Ports used by Check Point software

[Blason_R]

Those seems to be a httpd2 ports for multiportals. Since there are lot many portals running like captive portal, Mobile access portal, NAC, userChek on Apache and there are vhosts configuration done under Apache and those ports then start listening on then and has got a forwarding done internally 

e.g.

For me port 20988 listens on Apache2 which says it is opened for multiportal NAC/Captive Portal

/opt/CPshrd-R81/web/Apache/bin/httpd -DFOREGROUND -k start -f /opt/CPshrd-R81/conf/multiportal/httpd-conf/nac/httpd.conf -DPORTAL_NAME_nac

You will get more details from mpclient list command 

mpclient list
DLPSenderPortal
ExchangeRegistration
ReverseProxyClear
ReverseProxySSL
SecurePlatform
UserCheck
nac
nac_transparent_auth
saml-vpn
sslvpn

[_Val_]

First, half-open ports are not necessarily a vulnerability, even if Nessus thinks they are.  Vulnerability is something you can exploit.

Second, if you believe you indeed found a vulnerability in any of Check Point products, the only correct way to disclose it is to adhere to responsible disclose principles and to use this form 

[PhoneBoy]

We use a number of random high TCP ports to redirect certain traffic to for various reasons (Threat Prevention, UserCheck, among others).
Even there is a vulnerability there, it’s only accessible from the local system and would require root access (expert mode) to do so, which should only be provided to authorized individuals.
Which makes this “vulnerability” not interesting.

The fact a vulnerability scanner can find this suggests your access policy needs to be improved.
Best practice is to have a stealth rule in place that blocks all traffic to the gateway except for the traffic needed to manage the device.