Check Point Advisories

Non-SSH Traffic Over Port 22

Vulnerability
Protection

Check Point Reference:	CPAI-2012-074
Date Published:	27 Feb 2012
Severity:	High
Last Updated:	Friday 19 April, 2024
Source:
Protection Provided by:	Security Gateway R75 R71 R70
Who is Vulnerable?	Computer networks
Vulnerability Description	TCP Port 22 is normally used to transfer SSH traffic. Non-SSH traffic over this port may be used for malicious purposes.
Vulnerability Details	Many applications scan for open SSH ports for malicious purposes. Non-SSH traffic over port 22 may indicate an attempt to pass malicious traffic to or outside the network.

Protection Overview

This protection will detect and block non-SSH traffic over port 22.

In order for the protection to be activated, update your product to the latest update. For information on how to update , go to SBP-2006-05, Protection tab and select the version of your choice.

Security Gateway R75 / R71 / R70

In the IPS tab, click Protections and find the Non-SSH Traffic Over Port 22 protection using the Search tool and Edit the protection's settings.
Install policy on all modules.

SmartView Tracker will log the following entries:
Attack Name: SSH Protection Violation
Attack Information: Non-SSH traffic over port 22