Check Point Advisories

Non-FTP Traffic Over Port 20/21

Vulnerability
Protection

Check Point Reference:	CPAI-2012-073
Date Published:	27 Feb 2012
Severity:	High
Last Updated:	Monday 25 November, 2024
Source:
Protection Provided by:	Security Gateway R75 R71 R70
Who is Vulnerable?	Computer networks
Vulnerability Description	TCP Port 20/21 is normally used to transfer FTP traffic. Non-FTP traffic over this port may be used for malicious purposes.
Vulnerability Details	Many applications scan for open FTP ports for malicious purposes. Non-FTP traffic over port 20/21 may indicate an attempt to pass malicious traffic to or outside the network.

Protection Overview

This protection will detect and block non-FTP traffic over port 20/21.

In order for the protection to be activated, update your product to the latest update. For information on how to update , go to SBP-2006-05, Protection tab and select the version of your choice.

Security Gateway R75 / R71 / R70

In the IPS tab, click Protections and find the Non-FTP Traffic Over Port 20/21 protection using the Search tool and Edit the protection's settings.
Install policy on all modules.

SmartView Tracker will log the following entries:
Attack Name: FTP Enforcement Violation
Attack Information: Non-FTP traffic over port 20/21