topic Re: Client-Initiated TLS Renegotiation DoS in General Topics

Client-Initiated TLS Renegotiation DoS

NeilDavey — Sat, 06 Mar 2021 08:20:35 GMT

We have had a pen test performed and an issue has been raised for our Gateways A,B and HA external IP's.

I have seen there "may" be a IPS Protection that could help with this:

TLS Client Initiated Renegotiation

But if we enabled this, the CP would potentially block this but we haven't actually fixed the issue at hand.

Would anyone know a fix for the attached or seen it themselves?

Thanks

PhoneBoy — Sat, 06 Mar 2021 08:42:53 GMT

The relevant CVE for this issue is: CVE-2011-1473
This is not something we are vulnerable to per: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92447
Specifically: Check Point puts all sorts of protections against DoS on the gateway (limiting the number of connections, limiting the amount of data, etc.)