topic Re: SegmentSmack and FragmentSmack - sk134253 in General Topics

SegmentSmack and FragmentSmack - sk134253

NaderAlly — Thu, 16 Aug 2018 19:06:56 GMT

Hi,

If you're using a perimeter Security Gateway, then you should read the sk134253 - Check Point response to SegmentSmack (CVE-2018-5390) and FragmentSmack (CVE-2018-5391) and patch your device!

Re: SegmentSmack and FragmentSmack - sk134253

Danny — Thu, 16 Aug 2018 20:26:42 GMT

Thanks Check Point for responding to this so quickly.

Awaiting updated Jumbo Hotfix Takes soon to solve the issue asap.

Re: SegmentSmack and FragmentSmack - sk134253

Yonatan_Philip — Fri, 17 Aug 2018 09:12:14 GMT

The hotfix is already available on CPUSE and is a recommended update - this is also mentioned In the SmartConsole in the Gateways & Servers tab.

HTH

Yonatan

Re: SegmentSmack and FragmentSmack - sk134253

J_7584 — Fri, 17 Aug 2018 17:29:44 GMT

Hmm, still running R77.30 and below jumbo hotfix 317. Does anyone know if this hotfix will be released or a workaround where 317 is not required as part of installing this hotfix?

Re: SegmentSmack and FragmentSmack - sk134253

NaderAlly — Fri, 17 Aug 2018 17:52:29 GMT

Have you tried to contact CP support? Based on their statement for R77.30 Jumbo HF Take lower than 317 - Check Point recommends to update to the latest Jumbo Hotfix Accumulator Take and install the Hotfix or contact Check Point Support

Re: SegmentSmack and FragmentSmack - sk134253

Dan_Roddy — Mon, 20 Aug 2018 14:58:37 GMT

Can you provide more info on this from sk134253?

"SegmentSmack could only be applied on a connection with protection that requires Active Steaming (SSL Inspection, Check Point Proxy, VoIP, Header Spoofing) and either this TCP connection is allowed to the internal network or local user is tricked to connect to a remote malicious server."

What does this mean? Are you saying there is a risk of a successful connection that will not be detected by SSL inspection? Can you please state what could happen with certainty?

Thank you,

Dan Roddy