Check Point VPN-1 R55, R65, and other versions, when Port Address Translation (PAT) is used, allows remote attackers to discover intranet IP addresses via a packet with a small TTL, which triggers an ICMP_TIMXCEED_INTRANS (aka ICMP time exceeded in-transit) response containing an encapsulated IP packet with an intranet address, as demonstrated by a TCP packet to the firewall management server on port 18264.
References
Configurations
Configuration 1 (hide)
|
History
No history.
Information
Published : 2009-01-06 17:30
Updated : 2024-02-28 11:21
NVD link : CVE-2008-5849
Mitre link : CVE-2008-5849
CVE.ORG link : CVE-2008-5849
JSON object : View
Products Affected
checkpoint
- vpn-1
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor