Portcullis Security Advisory – By sending crafted packets to ports on the Checkpoint VPN-1 which are mapped by port address translation (PAT) to ports on internal devices, information about the internal network may be disclosed in the resulting ICMP error packets.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/71968/PSA08-009.txt
Source: https://packetstormsecurity.com/files/71968/PSA08-009.txt.html