CVE-2002-0309

SMTP proxy in Symantec Enterprise Firewall SEF 6.5.x includes the firewall's physical interface name and address in an SMTP protocol exchange when NAT translation is made to an address other than the firewall, which could allow remote attackers to determine certain firewall configuration...

Linux kernel IP Masquerading "destination loose" (DLOOSE) configuration passes arbitrary UDP traffic

Overview The default configuration of the IP Masquerade feature of certain Linux 2.2 kernels may allow unsolicited inbound UDP packets to traverse a NAT gateway and reach a translated network. Description As defined in RFC 1631, Network Address Translation NAT provides a means to translate a loca...

CVE-1999-1339

CVE-1999-1339 affects Linux 2.2.10 and earlier (with ipchains) and FreeBSD 3.2 (with ipfw). The issue is triggered by a crafted ping -R (record route) packet, causing a remote attacker to induce a kernel panic and denial of service. The vulnerability arises from how NAT is handled when enabled, a...

CVE-2001-0860

The CVE-2001-0860 entry documents a vulnerability in Terminal Services Manager MMC on Windows 2000 and Windows XP where the service trusts the Client Address (IP) provided by the client instead of deriving it from packet headers. This enables IP address spoofing (e.g., via NAT). Root cause: the t...

CVE-2001-0860: Undefined Security Weakness

Terminal Services Manager MMC in Windows 2000 and XP trusts the Client Address IP address that is provided by the client instead of obtaining it from the packet headers, which allows clients to spoof their public IP address, e.g. through a Network Address Translation NAT...

CVE-2001-0444: Undefined Security Weakness

Cisco CBOS 2.3.0.053 sends output of the "sh nat" aka "show nat" command to the terminal of the next user who attempts to connect to the router via telnet, which could allow that user to obtain sensitive information...

CVE-2001-0908: Undefined Security Weakness

CITRIX Metaframe 1.8 logs the Client Address IP address that is provided by the client instead of obtaining it from the packet headers, which allows clients to spoof their public IP address, e.g. through Network Address Translation NAT...

CVE-2001-1018: Undefined Security Weakness

Lotus Domino web server 5.08 allows remote attackers to determine the internal IP address of the server when NAT is enabled via a GET request that contains a long sequence of / slash characters...

Check Point VPN-1/FireWall-1 4.1 on Nokia IPXXX firewall appliance retransmits original packets

Overview A vulnerability in Check Point VPN-1/FireWall-1 running on Nokia IPXXX Appliances can allow an attacker to pass traffic allowed by the security policy through the firewall while retaining the external untranslated destination IP address. Description Nokia IPXXX Appliances are security...

CVE-2001-1018

Lotus Domino web server 5.08 allows remote attackers to determine the internal IP address of the server when NAT is enabled via a GET request that contains a long sequence of / slash characters...

Weak TCP Sequence Numbers in Sonicwall SOHO Firewall

This may not seem bad, but to me it seems that this defeats the point of NAT if somebody can steal your sessions. Note the section on TCP sequence prediction. This was a Sonicwall SOHO firewall. ======= Host 192.168.1.254 appears to be up ... good. Initiating SYN half-open stealth scan against...

ALCATEL Speed Touch PRO port redirect exploit

Taking advantage from the ALCATEL Speed Touch Pro backdoor and configuration problems, it is possible to obtain a "full priv" access to the router and launch several attack against the internal LAN thanks to the NAT/PAT feature often made available. If the router is "telnetable" it means that "ip...

CVE-2000-1167: Undefined Security Weakness

ppp utility in FreeBSD 4.1.1 and earlier does not properly restrict access as specified by the "nat denyincoming" command, which allows remote attackers to connect to the target system...

Дырка в ppp в FreeBSD (nat deny_incoming)

команда nat denyincoming не работает с нестандартными типами протоколов например IPSec...

FreeBSD-SA-00:70.ppp-nat

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:70 Security Advisory FreeBSD, Inc. Topic: ppp "denyincoming" does not correctly deny incoming packets Category: core Module: ppp Announced: 2000-11-14 Credits: Robin...

TalentSoft Web+ Client/Monitor/server 4.6 - Internal IP Address Disclosure

source: https://www.securityfocus.com/bid/1720/info Talentsoft Web+ is a web application server that can be integrated with various web technologies. A vulnerability exists in one of the CGI applications implemented by Web+. It is possible for a remote user to retrieve the internal IP address in ...

Удаленный root через Gauntlet

Классическое переполнение буфера позволяет выполнение кода на сервере. Кроме того, в некоторых случаях некорректно работает NAT...

NAI Gauntlet mishandling of NAT

In some circumstances NAI Gauntlet firewall performs Network Address Translation in an unexpected manner, causing incorrect routable IP addresses to be generated. This can enable unprivileged users on the protected network to knowingly or unknowingly generate spurious source IP addresses. Vendor...

Security Problems with Linux 2.2.x IP Masquerading

Security Problems with Linux 2.2.x IP Masquerading Summary: Due to lax checking in the masquerading kernel code, an attacker is able to rewrite a linux masq gateway's UDP masquerading entries so that the remote host and port are whatever they choose. This creates a tunnel between whatever host an...

GameHouse dldisplay - ActiveX control 0 Real Server 5.07.0 Internal IP Address Disclosure

GameHouse dldisplay - ActiveX control 0 Real Server 5.07.0 Internal IP Address Disclosure source: https://www.securityfocus.com/bid/1049/info By default, Real Server includes the IP address of the server in data sent to the client. If the Real Server is installed on a machine in a NAT environment...