Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Check Point Firewall-1 Server remote code execution via username

CVE-2001-0940 · published 25 years ago
Summary

The management server for Check Point Firewall-1 (versions 4.0 and 4.1) can be tricked into running unwanted programs if an attacker sends a very long user name. This could let an outsider take control of the server and compromise your network. Apply the latest security update from Check Point or upgrade to a newer, patched version as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
checkpoint firewall-1 4.0
4.1
cpe:2.3:a:checkpoint:firewall-1:4.0:*:*:*:*:*:*:*
Original advisory text
Buffer overflow in the GUI authentication code of Check Point VPN-1/FireWall-1 Management Server 4.0 and 4.1 allows remote attackers to execute arbitrary code via a long user name.
Buffer overflow in the GUI authentication code of Check Point VPN-1/FireWall-1 Management Server 4.0 and 4.1 allows remote attackers to execute arbitrary code via a long user name.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
4% chance of attack within 30 days
Timeline
Published21 Sep 2001
Updated23 Oct 2026
First seen29 Sep 2026
Sources
CVE-2001-0940 · NVD
Track software like this
Free during beta