Check Point RDP exploit

[silverm]

Have there been any CSIDS signature updates to check for the Check Point RDP exploit that could allow an intruder to pass traffic through a Check Point Firewall-1 on port 259/UDP?

[mhossain]

You can do this right now with a "connection signature" looking for

connections to port 259/UDP.

Regards,

-Mun

IDS Product Manager

[silverm]

Your solution will fire an alarm on any traffic trying to establish a vpn, or client authorization. Sounds like a lot of false alarms.