CVE-2000-0804: Check Point VPN-1/FireWall-1 4.1 and earlier allows remote attackers to bypass the directionality check via...

Security readout for executives and security teams

An old flaw in Check Point VPN-1/FireWall-1 (version 4.1 and earlier) let remote attackers slip past the firewall's one-way traffic rules. By fragmenting TCP requests or reopening closed connections, an attacker could send traffic in a direction the policy was meant to block. This is a legacy issue relevant only to unsupported firewall deployments still in service. Exposure is limited to organizations still operating end-of-life Check Point VPN-1/FireWall-1 4.1 or earlier at network perimeters or between segmented zones. Modern Check Point gateways are not in scope. Any remaining exposure would be at internet-facing or trust-boundary firewalls where directional rules are relied upon for segmentation. Low priority for modern environments, but immediate priority if legacy Check Point 4.1 firewalls still exist. Treat as a hygiene and asset-inventory issue: confirm the product is retired. If any legacy gateway remains at a trust boundary, plan urgent replacement because directional segmentation controls cannot be trusted on it. Mitigation focus: Upgrade or replace any Check Point VPN-1/FireWall-1 4.1 or earlier gateways with a currently supported platform.; Consult Check Point's advisory for the specific service pack or hotfix addressing One-way Connection Enforcement.; Enforce strict fragmentation reassembly and drop overlapping or malformed TCP fragments at the perimeter..

Prepared

Jul 12, 2026, 00:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.