https://insinuator.net/tags/security/ Recent content in Security on Insinuator.net - Bold Statements Hugo en-us Fri, 16 Dec 2022 00:00:00 +0000 https://insinuator.net/2022/12/hilarious-buffer-overflow-mitigation-and-tcl-injection-in-checkpoint-gaia-portal/ Fri, 16 Dec 2022 00:00:00 +0000 https://insinuator.net/2022/12/hilarious-buffer-overflow-mitigation-and-tcl-injection-in-checkpoint-gaia-portal/ <p>Hey there,</p> <p>I am going to disclose two bug classes I found a while ago in CheckPoint R77.30: Two buffer overflows in the username (no shit) and HTTP method of a request to the administrative UI pre-auth and some interesting injections into the TCL web interface.</p> <p>Let’s start with the TCL part. The web interface reacted pretty weird when a payload contained a colon. Diving deeper into this it became clear that a colon would actually cause an error from the TCL interpreter. By going down this rabbit hole and learning some TCL (:D) you could see that injecting a colon breaks some part of the application code, probably because colons are control characters in TCL e.g. preceding a global variable in TCL (::MyVar) or separating namespaces.</p>