COMMAND

	Checkpoint FW1 SecuRemote/SecureClient \"re-authentication\" bypass

SYSTEMS AFFECTED

	Checkpoint FW1 4.0, 4.1 at any SP level,  and  NG  FP1  when  used  with
	SecuRemote/SecureClient

PROBLEM

	Cedric Amand [cedric@cedric.net] [http://techos.org/] says :
	

	When using Checkpoint FW1 together  with  Remote  Users  connected  thru
	SecuRemote   and   SecureClient   firewall   administrators   have   the
	possibility to make these remote users re-authenticate after X minutes.
	

	This can be found in FW1\'s GUI inside :
	

	           Global Properties -> Desktop Security -> Validation timeout

	

	However, this  setting  can  be  trivially  bypassed  by  modifiyng  the
	*client side*,  inside  Securemote\'s  \"users.C\"  configuration  file.
	Values to modify are \"to_expire (true)\" and/or \"expire (60)\"
	

	Replacing \"true\" by \"false\" will  make  your  connection  permanent,
	Changing the expire timeout (in minutes) to your liking can be  used  as
	well.

SOLUTION

	Patch should be comming anytime soon