| Package | Affected versions | Patched versions |
|---|---|---|
| vpn-1 | = r55= r65 |
Check Point VPN-1 R55, R65, and other versions, when Port Address Translation (PAT) is used, allows remote attackers to discover intranet IP addresses via a packet with a small TTL, which triggers an ICMP_TIMXCEED_INTRANS (aka ICMP time exceeded in-transit) response containing an encapsulated IP packet with an intranet address, as demonstrated by a TCP packet to the firewall management server on port 18264.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free