1815 matches found
CVE-2002-0419
Information leaks in IIS 4 through 5.1 allow remote attackers to obtain potentially sensitive information or more easily conduct brute force attacks via responses from the server in which 2 in certain configurations, the server IP address is provided as the realm for Basic authentication, which...
CVE-2002-0704
The Network Address Translation NAT capability for Netfilter "iptables" 1.2.6a and earlier leaks translated IP addresses in ICMP error messages...
Part II: Vulnerability in 3Com® OfficeConnect® Remote 812 ADSL Router
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 TITLE: A more detailed description of 3Com ® OfficeConnect® Remote 812 ADSL Router DESCRIPTION: A big description of the vulnerability, Status and Solutions. I send this mail to explain the real problem and the solutions to all these people that were...
CVE-2002-0309
SMTP proxy in Symantec Enterprise Firewall SEF 6.5.x includes the firewall's physical interface name and address in an SMTP protocol exchange when NAT translation is made to an address other than the firewall, which could allow remote attackers to determine certain firewall configuration...
Linux kernel IP Masquerading "destination loose" (DLOOSE) configuration passes arbitrary UDP traffic
Overview The default configuration of the IP Masquerade feature of certain Linux 2.2 kernels may allow unsolicited inbound UDP packets to traverse a NAT gateway and reach a translated network. Description As defined in RFC 1631, Network Address Translation NAT provides a means to translate a loca...
CVE-1999-1339
CVE-1999-1339 affects Linux 2.2.10 and earlier (with ipchains) and FreeBSD 3.2 (with ipfw). The issue is triggered by a crafted ping -R (record route) packet, causing a remote attacker to induce a kernel panic and denial of service. The vulnerability arises from how NAT is handled when enabled, a...
CVE-2001-0860
The CVE-2001-0860 entry documents a vulnerability in Terminal Services Manager MMC on Windows 2000 and Windows XP where the service trusts the Client Address (IP) provided by the client instead of deriving it from packet headers. This enables IP address spoofing (e.g., via NAT). Root cause: the t...
CVE-2001-0860: Undefined Security Weakness
Terminal Services Manager MMC in Windows 2000 and XP trusts the Client Address IP address that is provided by the client instead of obtaining it from the packet headers, which allows clients to spoof their public IP address, e.g. through a Network Address Translation NAT...
CVE-2001-0444: Undefined Security Weakness
Cisco CBOS 2.3.0.053 sends output of the "sh nat" aka "show nat" command to the terminal of the next user who attempts to connect to the router via telnet, which could allow that user to obtain sensitive information...
CVE-2001-1018: Undefined Security Weakness
Lotus Domino web server 5.08 allows remote attackers to determine the internal IP address of the server when NAT is enabled via a GET request that contains a long sequence of / slash characters...
CVE-2001-0908: Undefined Security Weakness
CITRIX Metaframe 1.8 logs the Client Address IP address that is provided by the client instead of obtaining it from the packet headers, which allows clients to spoof their public IP address, e.g. through Network Address Translation NAT...
Check Point VPN-1/FireWall-1 4.1 on Nokia IPXXX firewall appliance retransmits original packets
Overview A vulnerability in Check Point VPN-1/FireWall-1 running on Nokia IPXXX Appliances can allow an attacker to pass traffic allowed by the security policy through the firewall while retaining the external untranslated destination IP address. Description Nokia IPXXX Appliances are security...
CVE-2001-1018
Lotus Domino web server 5.08 allows remote attackers to determine the internal IP address of the server when NAT is enabled via a GET request that contains a long sequence of / slash characters...
Weak TCP Sequence Numbers in Sonicwall SOHO Firewall
This may not seem bad, but to me it seems that this defeats the point of NAT if somebody can steal your sessions. Note the section on TCP sequence prediction. This was a Sonicwall SOHO firewall. ======= Host 192.168.1.254 appears to be up ... good. Initiating SYN half-open stealth scan against...
ALCATEL Speed Touch PRO port redirect exploit
Taking advantage from the ALCATEL Speed Touch Pro backdoor and configuration problems, it is possible to obtain a "full priv" access to the router and launch several attack against the internal LAN thanks to the NAT/PAT feature often made available. If the router is "telnetable" it means that "ip...
CVE-2000-1167: Undefined Security Weakness
ppp utility in FreeBSD 4.1.1 and earlier does not properly restrict access as specified by the "nat denyincoming" command, which allows remote attackers to connect to the target system...
Дырка в ppp в FreeBSD (nat deny_incoming)
команда nat denyincoming не работает с нестандартными типами протоколов например IPSec...
FreeBSD-SA-00:70.ppp-nat
-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:70 Security Advisory FreeBSD, Inc. Topic: ppp "denyincoming" does not correctly deny incoming packets Category: core Module: ppp Announced: 2000-11-14 Credits: Robin...
TalentSoft Web+ Client/Monitor/server 4.6 - Internal IP Address Disclosure
source: https://www.securityfocus.com/bid/1720/info Talentsoft Web+ is a web application server that can be integrated with various web technologies. A vulnerability exists in one of the CGI applications implemented by Web+. It is possible for a remote user to retrieve the internal IP address in ...