> Source: [sk93326](https://support.checkpoint.com/results/sk/sk93326)

# sk93326 - Check Point response to CVE-2004-0230

| Property | Value |
|----------|-------|
| Solution ID | sk93326 |
| Date Created | 2013-06-25 |
| Last Modified | 2023-08-07 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * Qualys vulnerability scanner may report that Check Point Security Gateway is affected by [CVE-2004-0230](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2004-0230).
* The issue is reported for ports 80 and 443.
* Check Point Security Alert Team has analyzed this report and concluded that it is a **false positive**.

## Solution

CVE-2004-0230 refers to the ability of an attacker to 'blindly' guess TCP sequence numbers and inject RST packets into a TCP connection.

In particular, CVE-2004-0230 states that 'TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections by repeatedly injecting a TCP RST packet, especially in protocols that use long-lived connections, such as BGP.''

Qualys report is a false positive for the following reasons:

* Qualys scanner performs the following test:
  * Establish a TCP connection to the gateway on port 80 or 443.
  * Send SYN packet with the same 5-tupple and current sequence + 16 bytes.
  * If a RST packet is sent by the gateway, Qualys reports CVE-2004-0230.

This report is incorrect. Check Point's Smart Connection Reuse feature changes a SYN packet sent on an established connection to an ACK packet with the last sequence. In response to the ACK, the gateway's IP stack retransmits the SYN-ACK and the connection stays alive. **This behavior defeats the Qualys test.** For more information about the Smart Connection Reuse feature, refer to [sk24960](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk24960).

* Qualys scanner has reported this finding against ports 80 and 443. There are no long-lived persistent connections with large window size to these ports. These connections are short-lived and the window size will not grow significantly beyond the initial window size. Therefore, the CVE does not apply in this case.

<!-- -->

* The test performed by Qualys is not a valid test because it does not demonstrate 'guessing' of sequence numbers. A test executed with full knowledge of connection parameters (5-tupple and current sequence number) does not prove that it is 'easier for remote attackers to guess sequence numbers'. Therefore, the test itself is not relevant for this CVE.

**Please note that Qualys has reduced the severity rating of this finding so that the scan report will not fail PCI compliance.**

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content