Table of Contents:

1. Background
2. IPS Protection
3. Solution
4. Hotfix Packages
5. Revision History

 

(I) Background

Check Point products are not vulnerable to the "FREAK" vulnerability (CVE-2015-0204) with the following exceptions:

• Mobile Access Blade - When using the Mobile Access Portal to access a 3rd party application server (usually, internal server), and if the 3rd party server is vulnerable to FREAK attack, then the connection may be susceptible to it.

  Notes:

  1. Connections between the Mobile Access Gateway and the application server will usually be within the corporate LAN, which makes these connections less likely to be exposed to this vulnerability.
     
     
  2. The vulnerability still requires the attacker to be a Man-In-The-Middle (MITM).
  
  
  
• IPSO Voyager with SSL - By default IPSO does not configure HTTPS access to Voyager, so it is not vulnerable; but if this access is manualy configured, IPSO would accept connections with export grade cipher suites.
  
  Follow the below procedure to workaround this issue.
  
  
  
• Other Check Point products
  
  

  Feature / Appliance	Status
  Gaia Portal / SecurePlatform WebUI	Not Vulnerable
  600 / 1100 / Security Gateway 80 appliances	Not Vulnerable
  X-Series Appliances (Blue Coat)	Not Vulnerable
  Edge / Safe@Office devices	Not Vulnerable
  61000 / 41000 Security Systems	Vulnerable when Mobile Access Blade is enabled and Mobile Access Portal is used. Fix was integrated into Take_62 of Jumbo Hotfix Accumulator for R76SP.10.
  LOM card WebUI	Fixed in LOM firmware v2.2 (refer to sk101241)

 

(II) IPS Protection

Check Point released "OpenSSL TLS Export Cipher Suite Downgrade (CVE-2015-0204)" IPS protection that protects customer environments.
This protection is part of the Recommended profile. It enables organizations to add a layer of protection to their network while updating their systems with vendor-provided patches.

1. CVEs

   The IPS protection covers the following CVEs:

   • CVE-2015-0204
     
     
   • CVE-2015-1637

1. How can IPS best protect my environment?

   Verify that the protection is set to "Prevent" mode in all IPS profiles.

   To enable the "OpenSSL TLS Export Cipher Suite Downgrade (CVE-2015-0204)" IPS protection in Prevent mode: right-click on this protection, click on 'Prevent on All Profiles', and install policy on all Security Gateways.

Check Point also released the "SSL Export Cipher Suite" IPS protection that protects customer environments. This protection is not part of the Recommended profile. It will detect and block the usage of weak Export cipher suites

 

(III) Solution

It is highly recommended that the 3rd party Application Servers that are accessed through Mobile Access Blade will be configured to be not vulnerable to the FREAK attack.

In case Mobile Access Blade is configured to connect to a 3rd party Application Server that is vulnerable to FREAK attack, it is recommended to install the Hotfix below on the Security Gateway with enabled Mobile Access Blade. Refer to the "Hotfix Packages" section.

Check Point released a Hotfix for R77.20 and R77.10 (this hotfix is already integrated into R80.10 and R77.30). For other versions, contact Check Point Support (please collect CPinfo files from the Security Management Server and Security Gateways involved in the case).

Check Point continues the investigation and will update this SK article accordingly.

 

For IPSO Voyager manually configured to work with SSL the following workaround is available:

1. Connect to command line.
   
   

2. Open Clish:

   [root@HostName ~]# clish
   
   

3. Check the current SSL setting:

   IPSO:N> show voyager ssl-level

   • If this command returns "VoyagerSSLLevel 0", then SSL is not used and IPSO Voyager is not vulnerable.
     
     
   • If this command returns any value other than "0" (zero), then proceed to the next step.
   
   
   

4. Disable the weak "export" ciphers:

   IPSO:N> set voyager ssl-level 168
   IPSO:N> save config
   
   

5. Verify your configuration:

   IPSO:N> show voyager ssl-level

   The output should show "VoyagerSSLLevel 168"

 

(IV) Hotfix Packages

Hotfix packages are available for R77.20 and R77.10 (this hotfix is already integrated into R77.30).

Notes:

• For other versions, contact Check Point Support. For faster resolution and verification, please collect CPinfo file from the involved machine.
• To check which Hotfixes are installed on your Check Point machine refer to sk72800 - How to check which Hotfixes are installed on Check Point machine. You can use this to also check whether this Hotfix was successfully installed.
• In cluster environment, hotfix must be installed on all members of the cluster.
• In Management HA environment, hotfix must be installed on both Management Servers.

Instructions:

• Hotfix package for R77.20 and R77.10 - Gaia OS using CPUSE (Check Point Update Service Engine)
  
  

  • Online installation

    1. Connect to the Gaia Portal on your Check Point machine and navigate to Upgrades (CPUSE) pane (in Gaia R77.20) / to Software Updates pane (in Gaia R77.10 and lower) - click on Status and Actions.
    2. Select the hotfix package <Version> Hotfix for sk105062 (TLS FREAK Attack (CVE-2015-0204)) - click on Install Update button on the toolbar.
    3. When using CPUSE everything is being done automatically, so if a reboot is needed, the machine will automatically reboot. There is no need to reboot or run cpstop manually.
    
    
    

  • Offline installation

    In order to download these packages you will need to have a Software Subscription or Active Support plan.

    	R77.20	R77.10
    Gaia - CPUSE

  Notes:

  • For detailed installation instructions, refer to sk92449: CPUSE - Gaia Software Updates (including Gaia Software Updates Agent) - section "(4) How to work with CPUSE".
  • Hotfix has to be installed on all Security Gateways running Gaia OS.

  
  
  
• Hotfix package for R77.20 and R77.10 - Gaia OS (manual installation in Command Line)
  
  

  In order to download these packages you will need to have a Software Subscription or Active Support plan.

  Click here to see the available downloads.

  	R77.20	R77.10
  Gaia - CLI

  
  
  

  Procedure:

  1. Hotfix has to be installed on Security Gateways running Gaia OS.
  2. Download the relevant hotfix package from the table below, transfer the hotfix package to the machine and unpack it:
     [Expert@HostName]# tar -zxvf Check_Point_Hotfix_VERSION_OS_sk105062.tgz
  3. Install the hotfix:
     [Expert@HostName]# ./UnixInstallScript
     Note: The script will stop all of Check Point services ('cpstop') - read the output on the screen.
  4. Reboot is required.

 

These hotfix packages also include the following fixes:

• sk103683 - Check Point response to TLS 1.x padding vulnerability (CVE-2014-8730)
  
  
• sk102989 - Check Point response to the POODLE Bites vulnerability (CVE-2014-3566)
  
  
• sk101708 - Anti-Virus and Threat Emulation blades miss inspection

 

(V) Revision History