Check Point Advisories

Syslog over Non Standard Ports

Vulnerability
Protection

Check Point Reference:	SBP-2007-02
Date Published:	18 Oct 2006
Severity:	Low
Last Updated:	Sunday 15 September, 2024
Source:
Protection Provided by:	Security Gateway R81, R80, R77, R75, R71, R70, R65
Who is Vulnerable?
Vulnerability Description	Syslog is a standard for transporting event notification messages over IP networks to event message collectors, or Syslog servers. Syslog is often used for system management and security auditing. Syslog servers, by default, listen on UDP port 514. RFC 3164 recommends that the source port be UDP/514. A Syslog message originating from a source port other than UDP/514 may indicate that it was generated by a process other than Syslog. This free choice of source port may be used by attackers to forge or spoof Syslog messages against some Syslog implementations.

Protection Overview

This protection will detect and block Syslog messages that have a source port other than UDP/514.The detect mode makes it possible to track irregular source portmessages without blocking them.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R81 / R80 / R77 / R75 / R71 / R70 / R65

In the IPS tab, click Protections and find the Syslog over Non Standard Ports protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: Syslog Protocol Violation.
Attack Information: phpFileManager cmd Parameter Command Execution