Check Point Advisories

Syslog over Non Standard Ports

Check Point Reference: SBP-2007-02
Date Published: 18 Oct 2006
Severity: Low
Last Updated: 8 Aug 2016
Protection Provided by:

Security Gateway
R80, R77, R76, R75, R71, R70

Who is Vulnerable?
Vulnerability Description Syslog is a standard for transporting event notification messages over IP networks to event message collectors, or Syslog servers. Syslog is often used for system management and security auditing. Syslog servers, by default, listen on UDP port 514.RFC 3164 recommends that the source port be UDP/514.A Syslog message originating from a source port other than UDP/514 may indicate that it was generated by a process other than Syslog. This free choice of source port may be used by attackers to forge or spoof Syslog messages against some Syslog implementations.

Protection Overview

This protection will detect and block Syslog messages that have a source port other than UDP/514. The detect mode makes it possible to track irregular source portmessages without blocking them.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update.For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R76 / R75 / R71 / R70

  1. In the IPS tab, click Protections and find the Syslog over Non Standard Ports protection using the Search tool and Edit the protection's settings.
  2. Install policy on all modules.

This protection's log will contain the following information:

Attack Name:  Syslog Protocol Violation.
Attack Information:  The source port of a Syslog message is not UDP/514

This website uses cookies to ensure you get the best experience. Got it, Thanks! MORE INFO