CVE-2008-5849: Infoleak
Check Point VPN-1 R55, R65, and other versions, when Port Address Translation (PAT) is used, allows remote attackers to discover intranet IP addresses via a packet with a small TTL, which triggers an ICMPTIMXCEEDINTRANS (aka ICMP time exceeded in-transit) response containing an encapsulated IP packet with an intranet address, as demonstrated by a TCP packet to the firewall management server on port 18264.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable Port Address Translation (PAT) on Check Point VPN-1 to avoid disclosure of intranet IP addresses in ICMP Time Exceeded (ICMP_TIMXCEED_INTRANS) responses.
Check Point VPN-1 Port Address Translation (PAT) = disabled - Compensating control
Restrict or block external access to the firewall management server on TCP port 18264; permit management traffic only from trusted/administrative IP addresses.
- Compensating control
Block or filter outbound ICMP Type 11 (Time Exceeded) responses from the firewall to untrusted networks to prevent disclosure of encapsulated intranet IP addresses.
Event History
Frequently Asked Questions
What is the severity of CVE-2008-5849?
CVE-2008-5849 is considered a medium severity vulnerability.
How does CVE-2008-5849 affect network security?
CVE-2008-5849 allows remote attackers to potentially discover intranet IP addresses, undermining network security.
What versions of Check Point VPN-1 are affected by CVE-2008-5849?
CVE-2008-5849 affects Check Point VPN-1 versions R55, R65, and possibly other versions using Port Address Translation.
What can be done to mitigate CVE-2008-5849?
Mitigation for CVE-2008-5849 includes upgrading to a patched version of Check Point VPN-1 that addresses this vulnerability.
Is CVE-2008-5849 an isolated incident or part of a broader issue?
CVE-2008-5849 is an isolated vulnerability but highlights the risks associated with improper handling of packet transmission and address translation.