A vulnerability in Check Point Software Technologies Ltd.'s FireWall-1 and VPN-1 firewall products may allow intruders to tunnel illegitimate traffic into or out of corporate networks.

The hole was discovered last month by Inside Security GmbH, a spin-off of the University of Stuttgart's security team in Germany. The hole could be exploited to passively snoop inside corporate networks or to launch certain types of denial-of-service attacks, according to the CERT Coordination Center security response team at Pittsburgh-based Carnegie Mellon University, which issued a bulletin on the vulnerability last week.

"This is a pretty serious vulnerability [because] Check Point is one of the most widely deployed firewalls on the Internet," said Ian Finlay, a member of the CERT team.

The vulnerability involves Check Point's proprietary Reliable Data Protocol (RDP), which is used in the company's firewalls for internal communication among software components. By default, VPN-1 and FireWall-1 allow RDP packets to traverse firewall gateways to simplify encryption setup, according to Check Point's advisory.

Under some conditions, malicious packets with RDP headers could be constructed and allowed through the firewall.

"It would be a rare and obscure instance" for anyone to take advantage of this vulnerability, said Greg Smith a director at Check Point. "We know of no customers who have been affected by this."

According to Smith, only authenticated and authorized firewall administrators would be able to take advantage of the vulnerability to create problems. "It in no way allows any external hacker to penetrate or attack networks."

Users can get around the problem by installing a patch from Check Point. Until the patch can be applied, users can configure their routers to block access to the port that's exploited by the vulnerability, CERT said in its advisory.

Although no security incidents related to this vulnerability have been reported, CERT is recommending that all affected sites upgrade their software as soon as possible.

"The thing to keep in mind is that the very nature of a firewall is to block traffic from reaching your internal network. This is a situation where that assumed fundamental protection [is breached]," said CERT member Shawn Hernan.