CVE-2008-5849

Check Point VPN-1 R55, R65, and other versions, when Port Address Translation PAT is used, allows remote attackers to discover intranet IP addresses via a packet with a small TTL, which triggers an ICMPTIMXCEEDINTRANS aka ICMP time exceeded in-transit response containing an encapsulated IP packet...

CVE-2008-5849

CVE-2008-5849 affects Check Point VPN-1 with Port Address Translation (PAT) enabled (notably Check Point VPN-1 R55 and R65). The issue is information disclosure: an attacker can remotely send a crafted packet to the firewall management port (18264/tcp) and trigger an ICMP TIMXCEED_INTRANS respons...

CVE-2008-5849

Check Point VPN-1 R55, R65, and other versions, when Port Address Translation PAT is used, allows remote attackers to discover intranet IP addresses via a packet with a small TTL, which triggers an ICMPTIMXCEEDINTRANS aka ICMP time exceeded in-transit response containing an encapsulated IP packet...

Check Point response to "VPN-1 PAT information disclosure" vulnerability (CVE-2008-5849)

...

Checkpoint VPN-1 PAT information disclosure

Checkpoint VPN-1 PAT information disclosure By sending crafted packets to ports on the firewall which are mapped by port address translation PAT to ports on internal devices, information about the internal network may be disclosed in the resulting ICMP error packets. Port 18264/tcp on the firewal...

Check Point VPN-1 PAT Information Disclosure Vulnerability - Active Check

Check Point VPN-1 PAT is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2008 Tim Brown and Portcullis Computer Security Ltd Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Unfixed XSS vulnerability at baltru.net

Security researcher PaT, has submitted on 27/09/2007 a cross-site-scripting XSS vulnerability affecting baltru.net, which at the time of submission ranked 8218640 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 02/10/2007. It is currently...

Unfixed XSS vulnerability at wm42.com

Security researcher PaT, has submitted on 23/09/2007 a cross-site-scripting XSS vulnerability affecting wm42.com, which at the time of submission ranked 3738139 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 24/09/2007. It is currently unfixed...

Solaris 8 (x86) : 109235-10

SunOS 5.8x86: Apache Security and NCA Pat. Date this patch was last updated by Sun : Aug/08/02 %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended security fix. Disabled on 2011/09/17. C Tenable Network Security, Inc. if !...

CVE-2005-4202: Undefined Security Weakness

Multiple directory traversal vulnerabilities in LogiSphere 0.9.9j allow remote attackers to access arbitrary files via 1 .. dot dot, 2 "..." triple dot, and 3 "..//" sequences in the URL, 4 "../" sequences in the source parameter to viewsource.jsp, or 5 ".." dot dot backslash sequences in the...

CVE-2002-1042: Undefined Security Weakness

Directory traversal vulnerability in search engine for iPlanet web server 6.0 SP2 and 4.1 SP9, and Netscape Enterprise Server 3.6, when running on Windows platforms, allows remote attackers to read arbitrary files via ..\ dot-dot backslash sequences in the NS-query-pat parameter...

CVE-2002-0782

Novell BorderManager 3.5 with PAT (Port-Address Translate) enabled is affected. The issue allows remote attackers to cause a denial of service by saturating the connection table with a high volume of requests to hosts without a specific route, which may be forwarded to the public interface. The p...

CVE-2002-0782: Undefined Security Weakness

Novell BorderManager 3.5 with PAT Port-Address Translate enabled allows remote attackers to cause a denial of service by filling the connection table with a large number of connection requests to hosts that do not have a specific route, which may be forwarded to the public interface...

ALCATEL Speed Touch PRO port redirect exploit

Taking advantage from the ALCATEL Speed Touch Pro backdoor and configuration problems, it is possible to obtain a "full priv" access to the router and launch several attack against the internal LAN thanks to the NAT/PAT feature often made available. If the router is "telnetable" it means that "ip...

razor.password.txt

--| |-------------------- Shawn Clifford ---------------------| This advisory follows the RFP disclosure policy: http://www.wiretrip.net/rfp/policy.html ----| ISSUE Razor is a configuration management tool see http://www.razor.visible.com. There is a serious flaw with the Razor password file,...