Latest firmware builds for 77.20.xx SMB appliances

[G_W_Albrecht]

In sk165875: Check Point Response to CVE-2020-8597 (PPP buffer overflow vulnerability) we found the latest 77.20.xx firmware builds for SMB appliances - but now in response to DNSpooQ (CVE-2020-25686, CVE-2020-25684, CVE-2020-25685), CP TAC provided fixed versions also for older models (2021-02):

• R77.20.80 Build 990172507 for 600/1100 Appliances
• R77.20.81 Build 990172611 for 1200R Appliances
• R77.20.87 Build 990173120 for 700/900/1400

With sk176148: Check Point response to CVE-2021-26414 - "Windows DCOM Server Security Feature Bypass" customers using MS DC/AD received fixed firmware versions that are available from TAC only (01-Nov-2021):

• R77.20.87 build 990173127 for 700/1400 appliances
• R77.20.81 Build 990172625 for 1200R appliances

[Steffen_Appel]

Trying to get it now.

[Naftali_Oziel]

let me know how it goes.

[Steffen_Appel]

The supporter doesnt find anything newer than 3072 for 1400 or 2500 for 1100...

[Naftali_Oziel]

You need to advise them you're looking for the custom build as advised on website associated to SMB's I provided you.   They will than talk to a Sr. tech and provide you with a link to download it.  It's there and available.    I've ran into that same issue in the past with Tier 1 support, checkpoint needs to improve training for those folks.  

[G_W_Albrecht]

Do you have any of the issues fixed in the custom build ? Or why is a build > R77.20.87 (990173072) necessary ?

[Naftali_Oziel]

unfortunately site is not allowing me to repost the fixes for B3077, they are listed on page 1. 

[G_W_Albrecht]

I see no immediate need for this version as long as i do not have one of the resolved issues ! If i have one of these, i can always get it from TAC - but a prefer a version without reboots every week 😎

[Naftali_Oziel]

makes sense.   Are your reboot still happening with B3072?  This weekend am testing to see how well it holds up after 30 days and logging into GUI if it cores or not.

[G_W_Albrecht]

Currently no frequent reboots 😎, but i remember a firmware version i do not want to speak of....

[HristoGrigorov]

There is new exciting JHF released: 990173081 

[G_W_Albrecht]

Yes, including the fix for DNSPooQ on internal (LAN, Wi-Fi) networks. 

[Steffen_Appel]

It is removed from the JHFA again and it did contain the old dnsmasq, I guess tehre will be another one soon.

[Steffen_Appel]

ACcording to https://community.checkpoint.com/t5/SMB-Appliances-and-SMP/Are-the-SMB-devices-vulnerable-to-DNSpooQ... it is 3083

http://downloads.checkpoint.com/fileserver/ID/112528/FILE/fw1_sx_dep_R77_990173083_20.img

[Naftali_Oziel]

Did anyone install B3083 yet? 

[Steffen_Appel]

yes seems fine

[G_W_Albrecht]

Updated with new versions in response to DNSpooQ 

Removed 1200R SmartUpdate package.

[Brian_Whipkey]

Hi everyone,

Since I've upgraded my SG750 with the latest build (3083), the gateway is constantly having memory leaks and needs rebooted within 2 weeks.  Anyone else having this issue?

Thanks.

[G_W_Albrecht]

I do not - but i have a Lab 730 without a workload...

[Naftali_Oziel]

I have build B3083 on my CP1400 and it had it's issues were I needed to reboot the device monthly otherwise, when I would log into the GUI and navigate the logs or anything it would core and restart the sfwd.    So rebooting it monthly is a workaround.  Was given a custom build B3105 and while it should promising results, the GUI core still occurs so back with R&D.  Hopefully one day before am out of support in 2024 they will get it right.  

Point here, open a TAC and see if there is a custom firmware and maybe you'll have better results.  As B3083 is very buggy.

[Brian_Whipkey]

Thanks for the reply. Ok, I figured I couldn't be the only one with issues. I'm not doing anything crazy with it either. Using it at home (disabled wifi) with DHCP, and using an Asus wireless router plugged into the LAN port for all my wireless devices.

For the meantime, I flashed it back to B2960 just to keep it stable.

I'll go ahead and contact TAC about the issue and see if they have a newer build.

Thank you.

[Naftali_Oziel]

Definitely not you, i am also using it at home with basic setup, only logging what is required and only using the IPS and antibot.   Have the App control, URL disabled and antivirus disabled found those to be more problematic than useful so I use DNS entry that controls the URL sites for virus/malware.  shame as it's a powerful box but software is buggy.

[Steffen_Appel]

I though this https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_d... is the latest official build (2913).

[Naftali_Oziel]

yes and no.  different branch to only address the wifi vulnerability nothing more.  All other fixes are sitting on custom firmware and have it B3105.   As I understood by TAC they are to bring it all to the same branch level so unclear why they did this? it's just as buggy.

[Steffen_Appel]

Ok so 3105 (where can I get it) is the continuation of the jumbo branch?

[Naftali_Oziel]

it's custom firmware and believe it's to the jumbo branch and next GA should have all wifi fixes incorporated and other stuff but ETA unknown.  Open a TAC and request it, they will send you a link to d/l.  

[Steffen_Appel]

OK thanks

[G_W_Albrecht]

[jimm]

I am told R77.20.87 990173120_20 is the latest release. Would this be a reliable choice for an SMB 1450 non-wifi appliance?

[Chris_Atkinson]

Yes this is the latest GA release per: sk153433: Jumbo Hotfix Accumulator for R77.20.87

(sk176148 also notes R77.20.87 build 990173127 for 700/1400.)

[Naftali_Oziel]

There is another firmware but it's custom build B135 that addresses issues with watchtower and am sure other minor tweaks that are never disclosed.   Call into TAC for a copy.