Check Point VPN-1 Port Address Translation Information Disclosure Weakness

Bugtraq ID:	32306
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2008-5849
Remote:	Yes
Local:	No
Published:	Nov 14 2008 12:00AM
Updated:	Jan 07 2009 08:22PM
Credit:	Tim Brown and Mark Lowe - Portcullis Computer Security
Vulnerable:	Check Point Software VPN-1 Power/UTM NGX R65
Not Vulnerable:

Check Point VPN-1 Port Address Translation Information Disclosure Weakness

Check Point VPN-1 is prone to an information-disclosure weakness.

An attacker can exploit this issue to learn the IP of devices on the internal network. This may aid in further attacks.

Check Point VPN-1 Port Address Translation Information Disclosure Weakness

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

NOTE: The reporter of this issue states they have proof-of-concept code demonstrating this issue.

Check Point VPN-1 Port Address Translation Information Disclosure Weakness

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Check Point VPN-1 Port Address Translation Information Disclosure Weakness

References:

• Check Point response to VPN-1 PAT information disclosure vulnerability (Check Point)
  
• Checkpoint VPN-1 PAT information disclosure (Portcullis Computer Security)
  
• Vendor Homepage (Check Point Software)