Code injection

Check Point VPN-1 R55, R65, and other versions, when Port Address Translation PAT is used, allows remote attackers to discover intranet IP addresses via a packet with a small TTL, which triggers an ICMPTIMXCEEDINTRANS aka ICMP time exceeded in-transit response containing an encapsulated IP packet...

CVE-2008-5849

CVE-2008-5849 affects Check Point VPN-1 with Port Address Translation (PAT) enabled (notably Check Point VPN-1 R55 and R65). The issue is information disclosure: an attacker can remotely send a crafted packet to the firewall management port (18264/tcp) and trigger an ICMP TIMXCEED_INTRANS respons...