Checkpoint VPN-1 PAT信息泄露漏洞

CVECAN ID: CVE-2008-5849 CheckPoint防火墙/VPN解决方案可为组织提供网络架构和信息安全保护。 对于启用了端口地址翻译（PAT）的CheckPoint VPN-1防火墙，如果远程攻击者向防火墙的18264/tcp端口发送设置有很低TTL值的报文的话，就可以触发ICMPTIMXCEEDINTRANS响应，而响应的封装IP报文中包含有内部IP地址，如下所示： 14:56:25.169480 IP tos 0xe0, ttl 255, id 21407, offset 0, flags none, proto: ICMP 1, length: 68...

CVE-2008-5849

Check Point VPN-1 R55, R65, and other versions, when Port Address Translation PAT is used, allows remote attackers to discover intranet IP addresses via a packet with a small TTL, which triggers an ICMPTIMXCEEDINTRANS aka ICMP time exceeded in-transit response containing an encapsulated IP packet...

CVE-2008-5849

CVE-2008-5849 affects Check Point VPN-1 with Port Address Translation (PAT) enabled (notably Check Point VPN-1 R55 and R65). The issue is information disclosure: an attacker can remotely send a crafted packet to the firewall management port (18264/tcp) and trigger an ICMP TIMXCEED_INTRANS respons...

Checkpoint VPN-1 PAT information disclosure

Checkpoint VPN-1 PAT information disclosure By sending crafted packets to ports on the firewall which are mapped by port address translation PAT to ports on internal devices, information about the internal network may be disclosed in the resulting ICMP error packets. Port 18264/tcp on the firewal...

Check Point VPN-1 PAT Information Disclosure Vulnerability - Active Check

Check Point VPN-1 PAT is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2008 Tim Brown and Portcullis Computer Security Ltd Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

ICMP domain name request

The remote host answered to an ICMP SPDX-FileCopyrightText: 2008 Michel Arboi Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only References: RFC 1788...

ICMP domain name request

The remote host answers to ICMP 'domain name' messages. Description : The remote host answered to an ICMP 'Domain Name Request' as defined in RFC 1788. Such a request is designed to obtain the DNS name of a host based on its IP. OpenVAS Vulnerability Test $Id: icmpdomainname.nasl 7176 2017-09-18...

Security Best Practice: Familiarize Yourself with the Time to Live (TTL) Masking Protection

Each IP packet has a field called "Time to Live", or TTL. Each router along the way decrements this value by one. When the router decrements this value to zero it drops the packet and sends an ICMP notifying about the event...

Security Best Practice: Familiarize Yourself with the Max Ping Size Protection

Ping is a computer network administration utility used to test whether a particular host is reachable across an IP network and to measure the round-trip time for packets sent from the local host to a destination computer, including the local host's own interfaces.Ping operates by sending Internet...

Linksys SPA-2102 wireless IP phones DoS

Large ICMP packets cause device to crash...

Design/Logic Flaw

Unspecified vulnerability in the Internet Protocol IP implementation in Sun Solaris 8, 9, and 10 allows remote attackers to bypass intended firewall policies or cause a denial of service panic via unknown vectors, possibly related to ICMP packets and IP fragment reassembly...

CVE-2008-1095

Unspecified vulnerability in the Internet Protocol IP implementation in Sun Solaris 8, 9, and 10 allows remote attackers to bypass intended firewall policies or cause a denial of service panic via unknown vectors, possibly related to ICMP packets and IP fragment reassembly...

CVE-2008-1095

Unspecified vulnerability in the Internet Protocol IP implementation in Sun Solaris 8, 9, and 10 allows remote attackers to bypass intended firewall policies or cause a denial of service panic via unknown vectors, possibly related to ICMP packets and IP fragment reassembly...

CVE-2008-1095

CVE-2008-1095 affects the Internet Protocol (IP) implementation in Sun Solaris 8, 9, and 10. The vulnerability is described as an unspecified issue that allows remote attackers to bypass firewall policies or cause a denial of service (panic) via unknown vectors, with possible involvement of ICMP ...

Nortel IP Phone DoS

Large fragmented ICMP packet causes device to crash...

Cisco Security Advisory: Cisco Unified IP Phone Overflow and Denial of Service Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco Unified IP Phone Overflow and Denial of Service Vulnerabilities Revision 1.0 For Public Release 2008 February 13 1600 UTC GMT +-------------------------------------------------------------------- Summary ======= Cisco...

Design/Logic Flaw

Cisco Unified IP Phone 7940, 7940G, 7960, and 7960G running SCCP firmware allows remote attackers to cause a denial of service reboot via a long ICMP echo request ping packet...

CVE-2008-0526

Cisco Unified IP Phone 7940, 7940G, 7960, and 7960G running SCCP firmware allows remote attackers to cause a denial of service reboot via a long ICMP echo request ping packet...

A paper by Amit Klein (Trusteer): "OpenBSD DNS Cache Poisoning and Multiple O/S Predictable IP ID Vulnerability"

Hello BugTraq Recently I've been looking at the OpenBSD PRNG implementation for DNS transaction ID OpenBSD ported BIND 9 into their code tree, but rolled their own PRNG for the DNS transaction ID field. I discovered a serious weakness in OpenBSD's PRNG, which allows an attacker to predict the nex...

Solaris 10 ICMP Packet Handling DoS

The remote host appears to be running a version of Solaris 10 that contains a vulnerability in its ICMP handling process that can be leveraged by an unauthenticated remote attacker to panic the affected host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...