Secunia

Tim Brown and Mark Lowe have reported a vulnerability in Checkpoint VPN-1 products, which can be exploited by malicious people to disclose certain system information.

The vulnerability is caused due to an error in the port address translation (PAT) feature when responding with ICMP time exceeded messages. This can be exploited to disclose e.g. the internal IP address of the firewall management server by sending a specially crafted packet containing a low time-to-live (TTL) value to port 18264/TCP.

Solution
The vendor recommends to block ICMP errors.

Provided and/or discovered by
Tim Brown and Mark Lowe, Portcullis Computer Security

Changelog
Further details available in Customer Area

Original Advisory
CheckPoint (Solution ID: sk36321):
https://supportcenter.checkpoint.com/supportcenter/index.jsp

Portcullis Computer Security:
http://www.portcullis.co.uk/293.php

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available in Customer Area