topic Re: No information about new vulnerability in IPS blade. in General Topics

No information about new vulnerability in IPS blade.

Matlu — Sun, 25 Jun 2023 22:45:50 GMT

Hello,

I have a Firewall Cluster, version R81.10.
Currently the Cluster has the IPS blade active.

Our Cybersecurity area has made the detection of a new signature, which require to know if this signature "impacts" or not to any asset of our company.

I have reviewed in the IPS Protections option from the SmartConsole, the signature that was reported to me, which is:

Vulnerability in Check Point (CVE-2023-34460) (CVSS Score v3: Undefined).

But you will notice in the attached image, that apparently, Checkpoint, does not have it included in its database, or I'm checking wrong????

What kind of action can be taken in this case?
Currently I have the following version of IPS signatures installed in my Cluster Firewalls.

Just to clarify the doubt, the signatures that I find with the "PREVENT" action in Checkpoint's database, does it mean that Checkpoint "blocks" this type of traffic?

Prevent, is it related to the action of BLOCKING all traffic? Or is it not always like that?

Thanks for your comments.

Re: No information about new vulnerability in IPS blade.

Chris_Atkinson — Sun, 25 Jun 2023 23:39:48 GMT

Generally only when POC code is available can a protection be created.

If this is critical for you please work with your local CP SE to track it.

'Prevent' does what it says but there can be some dependencies depending on the type of threat/traffic e.g. HTTPS inspection

Re: No information about new vulnerability in IPS blade.

Timothy_Hall — Mon, 26 Jun 2023 12:30:28 GMT

You need to update your SmartConsole software. In some early releases you were not allowed to search by CVE number, however this was fixed in later releases. From my IPS/AV/ABOT Immersion Course (which was just updated for R81.20) discussing the searching of IPS Protections:

Re: No information about new vulnerability in IPS blade.

Chris_Atkinson — Mon, 26 Jun 2023 12:36:42 GMT

Alternately you can also search your CVE here: https://advisories.checkpoint.com/advisories/

Re: No information about new vulnerability in IPS blade.

Matlu — Mon, 26 Jun 2023 13:48:21 GMT

Hello,

I checked my CVE on that page, and it doesn't appear in "LIST" either.

It is recommended to work with the SE, isn't it?

Cheers.

Re: No information about new vulnerability in IPS blade.

Matlu — Mon, 26 Jun 2023 13:50:22 GMT

Hello,

Is it possible to "work" with the SmartConsole R81.20, to access my SMS which is in version R81.10?

Or am I forced to update the SMS Gaia to R81.20?

Greetings.

Re: No information about new vulnerability in IPS blade.

Chris_Atkinson — Mon, 26 Jun 2023 13:51:59 GMT

The SE can make a request internally, again depending on POC code availability.

Re: No information about new vulnerability in IPS blade.

PhoneBoy — Mon, 26 Jun 2023 18:54:40 GMT

A cursory read of CVE-2023-34460 suggests the issue is in a piece of software used to build other software.
I fail to see how any network-based IPS would protect against this vulnerability.