SegmentSmack and FragmentSmack - sk134253

[NaderAlly]

Hi,

If you're using a perimeter Security Gateway, then you should read the sk134253 - Check Point response to SegmentSmack (CVE-2018-5390) and FragmentSmack (CVE-2018-5391) and patch your device!

[Danny]

Thanks Check Point for responding to this so quickly.

Awaiting updated Jumbo Hotfix Takes soon to solve the issue asap.

[Yonatan_Philip]

The hotfix is already available on CPUSE and is a recommended update - this is also mentioned In the SmartConsole in the Gateways & Servers tab.

HTH 

 Yonatan

[Josh_Browning]

Hmm, still running R77.30 and below jumbo hotfix 317. Does anyone know if this hotfix will be released or a workaround where 317 is not required as part of installing this hotfix?

[NaderAlly]

Have you tried to contact CP support? Based on their statement for R77.30 Jumbo HF Take lower than 317 - Check Point recommends to update to the latest Jumbo Hotfix Accumulator Take and install the Hotfix or contact Check Point Support

[Dan_Roddy]

Can you provide more info on this from sk134253?

"SegmentSmack could only be applied on a connection with protection that requires Active Steaming (SSL Inspection, Check Point Proxy, VoIP, Header Spoofing) and either this TCP connection is allowed to the internal network or local user is tricked to connect to a remote malicious server."

What does this mean?  Are you saying there is a risk of a successful connection that will not be detected by SSL inspection?  Can you please state what could happen with certainty?

Thank you,

Dan Roddy