CVE-2008-5849

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

1.62%

Published

Jan 6, 2009

Modified

Apr 22, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Check Point VPN-1 R55, R65, and other versions, when Port Address Translation (PAT) is used, allows remote attackers to discover intranet IP addresses via a packet with a small TTL, which triggers an ICMP_TIMXCEED_INTRANS (aka ICMP time exceeded in-transit) response containing an encapsulated IP packet with an intranet address, as demonstrated by a TCP packet to the firewall management server on port 18264.

Weaknesses (CWE)

CWE-200

Affected Products (2)

checkpoint · vpn-1vulnerable

References (14)

http://secunia.com/advisories/32728

http://www.portcullis-security.com/293.php

http://www.securityfocus.com/bid/32306

http://www.vupen.com/english/advisories/2008/3229

https://exchange.xforce.ibmcloud.com/vulnerabilities/46645

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk36321

https://svn.wald.intevation.org/svn/openvas/trunk/openvas-plugins/scripts/checkpoint-vpn1-pat-information-disclosure.nasl