Media Alert

Check Point Provides Multiple Protections Against Heartbleed

SAN CARLOS, CA--(Marketwired - Apr 15, 2014) - Check Point^® Software Technologies Ltd. (NASDAQ: CHKP), the worldwide leader in securing the internet, today announced that its network security products offer multiple protections from the Heartbleed vulnerability, providing for the security of customers' clients, servers and the integrity of their network data. 

Check Point network security products are not susceptible to Heartbleed exploits as the company utilizes a non-vulnerable version of OpenSSL. The company also provided multiple protections against attacks leveraging the Heartbleed bug that include:

• Check Point's implementation of HTTPS inspection that automatically prevents Heartbleed traffic. This was first introduced in 2011 with R75.20.
• Check Point released IPS protections to detect and block exploits from Heartbleed, on April 9, 2014.
• For more information, see:
  • sk100173 - Check Point response to OpenSSL vulnerability (CVE-2014-0160)
  • sk100246 - Check Point IPS Protections for OpenSSL Heartbleed vulnerability (CVE 2014-0160)
    
    

"The Heartbleed vulnerability is a critical and far-reaching security threat that potentially exposes sensitive personal and business information to remote hackers. Check Point's products provide multiple elements of protection against Heartbleed. First, our network security products are not vulnerable to this threat as Check Point uses a non-vulnerable version of OpenSSL. Second, our HTTPS inspection inherently prevents Heartbleed traffic. Finally, our timely IPS protection will detect and block attempts to exploit this vulnerability," said Dorit Dor, vice president of products at Check Point Software Technologies.

Additional Information on Heartbleed:

• The National Vulnerability Database (NVD) Common Vulnerabilities and Exposures entry describes CVE-2014-0160, aka "Heartbleed" as: "The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys... aka the Heartbleed bug."
• Heartbleed.com describes the vulnerability as: "The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library... The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users."