topic Re: Question regarding traffic handling? in Firewall and Security Management

Question regarding traffic handling?

Joe_Kanaszka — Mon, 05 May 2025 18:41:27 GMT

R81.20

This is concerning CVE-2024-24919.

We applied the hotfix last year for this and all the recommended other steps.

We use a third party XDR system, and while going through the events from today, I noticed that it says that my Check Point "did not block" traffic related to CVE-2024-24919.

When I look at my Check Point logs in Smart Log, I can only see two entries at the same exact time:. One is my firewall blade telling me it let this traffic through.

The other entry is telling me my IPS rule for CVE-2024-24919 prevented it.

I'm guessing this traffic was blocked by my IPS, but why would this pacet not be "dropped" at the gateway, or is this just a GUI quirk Check Point?

Thank you!

Re: Question regarding traffic handling?

the_rock — Mon, 05 May 2025 20:07:55 GMT

Do you see the CVE in the logs?

Andy

Re: Question regarding traffic handling?

PhoneBoy — Mon, 05 May 2025 23:31:09 GMT

Please make sure ALL of your Check Point gateways are properly patched/upgraded to fix CVE-2024-24919, not just using the IPS signature for it: https://support.checkpoint.com/results/sk/sk182336

In any case, an Access Policy "accept" followed by a Threat Prevention "drop" is normal since we process Access Policy rules before Threat Prevention.
Which means the traffic should have been dropped by IPS.

What evidence does the XDR provide that the relevant traffic wasn't blocked?