Details of VAR-200901-0056

ID

VAR-200901-0056

CVE

CVE-2008-5849

TITLE

Check Point VPN-1 Intranet IP Address disclosure vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2008-002165

DESCRIPTION

Check Point VPN-1 R55, R65, and other versions, when Port Address Translation (PAT) is used, allows remote attackers to discover intranet IP addresses via a packet with a small TTL, which triggers an ICMP_TIMXCEED_INTRANS (aka ICMP time exceeded in-transit) response containing an encapsulated IP packet with an intranet address, as demonstrated by a TCP packet to the firewall management server on port 18264. Check Point VPN-1 is prone to an information-disclosure weakness. An attacker can exploit this issue to learn the IP of devices on the internal network. This may aid in further attacks. ---------------------------------------------------------------------- Did you know that a change in our assessment rating, exploit code availability, or if an updated patch is released by the vendor, is not part of this mailing-list? Click here to learn more: http://secunia.com/advisories/business_solutions/ ---------------------------------------------------------------------- TITLE: Checkpoint VPN-1 Information Disclosure Vulnerability SECUNIA ADVISORY ID: SA32728 VERIFY ADVISORY: http://secunia.com/advisories/32728/ CRITICAL: Not critical IMPACT: Exposure of system information WHERE: >From remote SOFTWARE: Check Point VPN-1/FireWall-1 NGX http://secunia.com/advisories/product/6010/ Check Point VPN-1 UTM NGX http://secunia.com/advisories/product/13346/ Check Point VPN-1 Power NGX http://secunia.com/advisories/product/13348/ DESCRIPTION: Tim Brown and Mark Lowe have reported a vulnerability in Checkpoint VPN-1 products, which can be exploited by malicious people to disclose certain system information. The vulnerability is caused due to an error in the port address translation (PAT) feature when responding with ICMP time exceeded messages. This can be exploited to disclose e.g. SOLUTION: The vendor recommends to block ICMP errors. PROVIDED AND/OR DISCOVERED BY: Tim Brown and Mark Lowe, Portcullis Computer Security ORIGINAL ADVISORY: CheckPoint (Solution ID: sk36321): https://supportcenter.checkpoint.com/supportcenter/index.jsp Portcullis Computer Security: http://www.portcullis.co.uk/293.php ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.07

sources: NVD: CVE-2008-5849 // JVNDB: JVNDB-2008-002165 // BID: 32306 // VULHUB: VHN-35974 // PACKETSTORM: 72178

AFFECTED PRODUCTS

vendor:	checkpoint	model:	vpn-1	scope:	eq	version:	r55	Trust: 1.6
vendor:	checkpoint	model:	vpn-1	scope:	eq	version:	r65	Trust: 1.6
vendor:	check point	model:	vpn-1 power/utm	scope:	eq	version:	ngx r65	Trust: 0.8
vendor:	check	model:	point software vpn-1 power/utm ngx r65	scope:	-	version:	-	Trust: 0.3

sources: BID: 32306 // JVNDB: JVNDB-2008-002165 // CNNVD: CNNVD-200901-038 // NVD: CVE-2008-5849

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2008-5849
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2008-5849
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-200901-038
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-35974
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2008-5849
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-35974
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-35974 // JVNDB: JVNDB-2008-002165 // CNNVD: CNNVD-200901-038 // NVD: CVE-2008-5849

PROBLEMTYPE DATA

problemtype:

CWE-200

Trust: 1.9

sources: VULHUB: VHN-35974 // JVNDB: JVNDB-2008-002165 // NVD: CVE-2008-5849

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200901-038

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-200901-038

CONFIGURATIONS

sources: JVNDB: JVNDB-2008-002165

PATCH

title:

sk36321

url:

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk36321

Trust: 0.8

sources: JVNDB: JVNDB-2008-002165

EXTERNAL IDS

db:	BID	id:	32306	Trust: 2.8
db:	NVD	id:	CVE-2008-5849	Trust: 2.8
db:	SECUNIA	id:	32728	Trust: 2.6
db:	VUPEN	id:	ADV-2008-3229	Trust: 2.5
db:	JVNDB	id:	JVNDB-2008-002165	Trust: 0.8
db:	CNNVD	id:	CNNVD-200901-038	Trust: 0.7
db:	XF	id:	46645	Trust: 0.6
db:	XF	id:	1	Trust: 0.6
db:	VULHUB	id:	VHN-35974	Trust: 0.1
db:	PACKETSTORM	id:	72178	Trust: 0.1

sources: VULHUB: VHN-35974 // BID: 32306 // JVNDB: JVNDB-2008-002165 // PACKETSTORM: 72178 // CNNVD: CNNVD-200901-038 // NVD: CVE-2008-5849

REFERENCES

url:	http://www.securityfocus.com/bid/32306	Trust: 2.5
url:	http://www.vupen.com/english/advisories/2008/3229	Trust: 2.5
url:	http://www.portcullis-security.com/293.php	Trust: 2.0
url:	http://secunia.com/advisories/32728	Trust: 1.7
url:	https://supportcenter.checkpoint.com/supportcenter/portal?eventsubmit_dogoviewsolutiondetails=&solutionid=sk36321	Trust: 1.6
url:	https://svn.wald.intevation.org/svn/openvas/trunk/openvas-plugins/scripts/checkpoint-vpn1-pat-information-disclosure.nasl	Trust: 1.1
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/46645	Trust: 1.1
url:	http://secunia.com/advisories/32728/	Trust: 0.9
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-5849	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2008-5849	Trust: 0.8
url:	http://xforce.iss.net/xforce/xfdb/46645	Trust: 0.6
url:	https://supportcenter.checkpoint.com/supportcenter/portal?eventsubmit_dogoviewsolutiondetails=&solutionid=sk36321&js_peid=p-114a7ba5fd7-10001&partition=null&product=vpn-1	Trust: 0.3
url:	http://www.checkpoint.com	Trust: 0.3
url:	https://supportcenter.checkpoint.com/supportcenter/portal?eventsubmit_dogoviewsolutiondetails=&solutionid=sk36321	Trust: 0.1
url:	http://secunia.com/advisories/product/13346/	Trust: 0.1
url:	http://www.portcullis.co.uk/293.php	Trust: 0.1
url:	http://secunia.com/advisories/secunia_security_advisories/	Trust: 0.1
url:	http://secunia.com/advisories/product/6010/	Trust: 0.1
url:	https://supportcenter.checkpoint.com/supportcenter/index.jsp	Trust: 0.1
url:	http://secunia.com/advisories/business_solutions/	Trust: 0.1
url:	http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org	Trust: 0.1
url:	http://secunia.com/advisories/product/13348/	Trust: 0.1
url:	http://secunia.com/advisories/about_secunia_advisories/	Trust: 0.1

sources: VULHUB: VHN-35974 // BID: 32306 // JVNDB: JVNDB-2008-002165 // PACKETSTORM: 72178 // CNNVD: CNNVD-200901-038 // NVD: CVE-2008-5849

CREDITS

Tim Brown securityfocus@machine.org.uk

Trust: 0.6

sources: CNNVD: CNNVD-200901-038

SOURCES

db:	VULHUB	id:	VHN-35974
db:	BID	id:	32306
db:	JVNDB	id:	JVNDB-2008-002165
db:	PACKETSTORM	id:	72178
db:	CNNVD	id:	CNNVD-200901-038
db:	NVD	id:	CVE-2008-5849

LAST UPDATE DATE

2024-11-23T20:19:19.682000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-35974	date:	2017-08-08T00:00:00
db:	BID	id:	32306	date:	2009-01-07T20:22:00
db:	JVNDB	id:	JVNDB-2008-002165	date:	2009-01-13T00:00:00
db:	CNNVD	id:	CNNVD-200901-038	date:	2009-05-14T00:00:00
db:	NVD	id:	CVE-2008-5849	date:	2024-11-21T00:55:01.930

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-35974	date:	2009-01-06T00:00:00
db:	BID	id:	32306	date:	2008-11-14T00:00:00
db:	JVNDB	id:	JVNDB-2008-002165	date:	2009-01-13T00:00:00
db:	PACKETSTORM	id:	72178	date:	2008-11-21T16:47:01
db:	CNNVD	id:	CNNVD-200901-038	date:	2008-11-14T00:00:00
db:	NVD	id:	CVE-2008-5849	date:	2009-01-06T17:30:00.297