----------------------------------------------------------------------

Did you know that a change in our assessment rating, exploit code
availability, or if an updated patch is released by the vendor, is
not part of this mailing-list?

Click here to learn more:
http://secunia.com/advisories/business_solutions/

----------------------------------------------------------------------

TITLE:
Checkpoint VPN-1 Information Disclosure Vulnerability

SECUNIA ADVISORY ID:
SA32728

VERIFY ADVISORY:
http://secunia.com/advisories/32728/

CRITICAL:
Not critical

IMPACT:
Exposure of system information

WHERE:
>From remote

SOFTWARE:
Check Point VPN-1/FireWall-1 NGX
http://secunia.com/advisories/product/6010/
Check Point VPN-1 UTM NGX
http://secunia.com/advisories/product/13346/
Check Point VPN-1 Power NGX
http://secunia.com/advisories/product/13348/

DESCRIPTION:
Tim Brown and Mark Lowe have reported a vulnerability in Checkpoint
VPN-1 products, which can be exploited by malicious people to
disclose certain system information.

The vulnerability is caused due to an error in the port address
translation (PAT) feature when responding with ICMP time exceeded
messages. This can be exploited to disclose e.g. the internal IP
address of the firewall management server by sending a specially
crafted packet containing a low time-to-live (TTL) value to port
18264/TCP.

SOLUTION:
The vendor recommends to block ICMP errors.

PROVIDED AND/OR DISCOVERED BY:
Tim Brown and Mark Lowe, Portcullis Computer Security

ORIGINAL ADVISORY:
CheckPoint (Solution ID: sk36321):
https://supportcenter.checkpoint.com/supportcenter/index.jsp

Portcullis Computer Security:
http://www.portcullis.co.uk/293.php

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------