CVE-2006-3885 - Vulnerability Details - OpenCVE

Directory traversal vulnerability in Check Point Firewall-1 R55W before HFA03 allows remote attackers to read arbitrary files via an encoded .. (dot dot) in the URL on TCP port 18264.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Checkpoint	Firewall-1

Configuration 1 [-]

OR	cpe:2.3:a:checkpoint:firewall-1:r55w:::::::*
	cpe:2.3:a:checkpoint:firewall-1:r55w:hfa1::::::
	cpe:2.3:a:checkpoint:firewall-1:r55w:hfa2::::::

No data.

References

Link	Providers
http://secunia.com/advisories/21200
http://securityreason.com/securityalert/1290
http://securitytracker.com/id?1016563
http://www.sec-tec.co.uk/vulnerability/r55w_directory_traversal.html
http://www.securityfocus.com/archive/1/440990/100/0/threaded
http://www.securityfocus.com/archive/1/441495/100/0/threaded
http://www.securityfocus.com/bid/19136
http://www.vupen.com/english/advisories/2006/2965
https://exchange.xforce.ibmcloud.com/vulnerabilities/27937

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2006-07-27T00:00:00

Updated: 2024-08-07T18:48:39.337Z

Reserved: 2006-07-26T00:00:00

Link: CVE-2006-3885

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2006-07-27T01:04:00.000

Modified: 2025-04-03T01:03:51.193

Link: CVE-2006-3885

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2006-07-24T00:00:00", "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in Check Point Firewall-1 R55W before HFA03 allows remote attackers to read arbitrary files via an encoded .. (dot dot) in the URL on TCP port 18264."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-17T20:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "20060726 Re: Check Point R55W Directory Traversal", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/441495/100/0/threaded"}, {"name": "fw1-encoded-characters-directory-traversal(27937)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27937"}, {"name": "1290", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/1290"}, {"name": "20060724 Check Point R55W Directory Traversal", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/440990/100/0/threaded"}, {"name": "19136", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/19136"}, {"name": "21200", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/21200"}, {"name": "1016563", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://securitytracker.com/id?1016563"}, {"tags": ["x_refsource_MISC"], "url": "http://www.sec-tec.co.uk/vulnerability/r55w_directory_traversal.html"}, {"name": "ADV-2006-2965", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2006/2965"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2006-3885", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Directory traversal vulnerability in Check Point Firewall-1 R55W before HFA03 allows remote attackers to read arbitrary files via an encoded .. (dot dot) in the URL on TCP port 18264."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "20060726 Re: Check Point R55W Directory Traversal", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/441495/100/0/threaded"}, {"name": "fw1-encoded-characters-directory-traversal(27937)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27937"}, {"name": "1290", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/1290"}, {"name": "20060724 Check Point R55W Directory Traversal", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/440990/100/0/threaded"}, {"name": "19136", "refsource": "BID", "url": "http://www.securityfocus.com/bid/19136"}, {"name": "21200", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/21200"}, {"name": "1016563", "refsource": "SECTRACK", "url": "http://securitytracker.com/id?1016563"}, {"name": "http://www.sec-tec.co.uk/vulnerability/r55w_directory_traversal.html", "refsource": "MISC", "url": "http://www.sec-tec.co.uk/vulnerability/r55w_directory_traversal.html"}, {"name": "ADV-2006-2965", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2006/2965"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T18:48:39.337Z"}, "title": "CVE Program Container", "references": [{"name": "20060726 Re: Check Point R55W Directory Traversal", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/441495/100/0/threaded"}, {"name": "fw1-encoded-characters-directory-traversal(27937)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27937"}, {"name": "1290", "tags": ["third-party-advisory", "x_refsource_SREASON", "x_transferred"], "url": "http://securityreason.com/securityalert/1290"}, {"name": "20060724 Check Point R55W Directory Traversal", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/440990/100/0/threaded"}, {"name": "19136", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/19136"}, {"name": "21200", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/21200"}, {"name": "1016563", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://securitytracker.com/id?1016563"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.sec-tec.co.uk/vulnerability/r55w_directory_traversal.html"}, {"name": "ADV-2006-2965", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2006/2965"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2006-3885", "datePublished": "2006-07-27T00:00:00", "dateReserved": "2006-07-26T00:00:00", "dateUpdated": "2024-08-07T18:48:39.337Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:checkpoint:firewall-1:r55w:*:*:*:*:*:*:*", "matchCriteriaId": "1975FDD7-C643-4B85-8238-723CADFCE227", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkpoint:firewall-1:r55w:hfa1:*:*:*:*:*:*", "matchCriteriaId": "B0A5C0EC-E233-477F-8F4E-6E65C9284DA8", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkpoint:firewall-1:r55w:hfa2:*:*:*:*:*:*", "matchCriteriaId": "A55D2D38-3D40-4163-B5A2-2186612C0AB3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in Check Point Firewall-1 R55W before HFA03 allows remote attackers to read arbitrary files via an encoded .. (dot dot) in the URL on TCP port 18264."}, {"lang": "es", "value": "Vulnerabilidad de salto de directorio en Check Point Firewall-1 R55W anterior a HFA03 permite a atacantes remotos leer archivos de su elecci\u00f3n mediante un .. (punto punto) codificado en el URL en el puerto TCP 18264."}], "id": "CVE-2006-3885", "lastModified": "2025-04-03T01:03:51.193", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2006-07-27T01:04:00.000", "references": [{"source": "cve@mitre.org", "url": "http://secunia.com/advisories/21200"}, {"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/1290"}, {"source": "cve@mitre.org", "url": "http://securitytracker.com/id?1016563"}, {"source": "cve@mitre.org", "url": "http://www.sec-tec.co.uk/vulnerability/r55w_directory_traversal.html"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/440990/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/441495/100/0/threaded"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Patch"], "url": "http://www.securityfocus.com/bid/19136"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2006/2965"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27937"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/21200"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securityreason.com/securityalert/1290"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securitytracker.com/id?1016563"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.sec-tec.co.uk/vulnerability/r55w_directory_traversal.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/440990/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/441495/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Patch"], "url": "http://www.securityfocus.com/bid/19136"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2006/2965"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27937"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}