The information you are about to copy is INTERNAL!
DO NOT share it with anyone outside Check Point.
How to check which Hotfixes are installed on a Check Point machine
Technical Level
Solution ID
sk72800
Technical Level
Product
All
Version
All
OS
SecurePlatform, SecurePlatform 2.6, Gaia, Crossbeam XOS
Platform / Model
All
Date Created
02-May-2012
Last Modified
09-Dec-2018
Solution
Check Point fixes the reported issues and provides hotfixes. Depending on the fixed code, a hotfix might be provided as a Linux kernel RPM with improved Linux kernel / improved hardware drivers, or as a separate hotfix package to replace Check Point files.
In order to check, which RPM packages were installed on the machine, collect the list of current RPM packages and compare it with the list of RPM packages, which were installed by default from ISO.
List of RPM packages, which are installed by default from ISO can only be obtained right after installing Check Point from ISO. Meaning, that a clean install must be performed (this can be done even in VMWare).
Check Point software consists of various parts - e.g., FW1 (main FireWall code), CVPN (Mobile Access code), SecurePlatform (OS code on Gaia / SecurePlatform), etc. Some hotfixes replace files only in one part, while other hotfixes replace files in several parts (e.g., Jumbo Hotfix Accumulators). Therefore, the search for hotfixes in Check Point Registry file should be performed in the entire file.
Refer to Check Point Registry file:
On Gaia / SecurePlatform / IPSO / XOS:
$CPDIR/registry/HKLM_registry.data
On Windows OS:
Information is saved in Windows Registry - in HKEY_LOCAL_MACHINE\SOFTWARE\CheckPoint\
Installation of a hotfix package should complete successfully - no errors, no failures.
Installation log file has to be created - /opt/CPInstLog/install_<HOTFIX_NAME>.elg (example: /opt/CPInstLog/install_fw1_wrapper_HOTFIX_FOXX_HF_HA40_041)
Uninstall script has to be created - /opt/CPsuite-<RXX>/uninstall_<HOTFIX_NAME> (example: /opt/CPsuite-R75.40/uninstall_fw1_wrapper_HOTFIX_FOXX_HF_HA40_041)
Excerpt from Release Notes of the 'FOXX_HF_HA40_041' hotfix:
Files updated by this hotfix (Linux):
=====================================
please verify that in the cpvinfo output on the below files you see :
Module Name = NACServer
Minor Release = foxx_hf_ha40_041
Build Number = 986041005
/opt/CPsuite-R75.40/fw1/lib/libpdplib.so
Therefore, we run: [Expert@HostName]# cpvinfo /opt/CPsuite-R75.40/fw1/lib/libpdplib.so | grep -E "Build|Minor"
The output should show: Build Number = 986041005 Minor Release = foxx_hf_ha40_041
Refer to sk98028 - Jumbo Hotfix Accumulator FAQ - Question 1 "How to check the Take number of the currently installed Jumbo Hotfix Accumulator (if it is installed)?"
Note: Regarding R80.10, since CPinfo build B914000164 the command # cpinfo -y all prints the Jumbo hotfix accumulator take number. See sk83860 for more information
On VSX Gateway, this command must be run from the context of VS0 (run "vsenv" command).
If no argument is specified, then the command will print: "RXX.XX Jumbo Hotfix Accumulator take_N is installed, see skXXXXX".
If "-n" argument is specified, then the command will print only the number of the Take (value "0" means that a reference to the Jumbo Hotfix Accumulator was not found in Check Point Registry).
If "-h" argument is specified, then the command will print the usage help.
For Take 86 and lower
If Jumbo Hotfix Accumulator was installed using Gaia CPUSE:
On VSX Gateway, this command must be run from the context of VS0 (run "vsenv" command).
If no argument is specified, then the command will print: "RXX.XX Jumbo Hotfix Accumulator take_N is installed, see skXXXXX".
If "-n" argument is specified, then the command will print only the number of the Take (value "0" means that a reference to the Jumbo Hotfix Accumulator was not found in Check Point Registry).
If "-h" argument is specified, then the command will print the usage help.
For Take 54 and lower
If Jumbo Hotfix Accumulator was installed using Gaia CPUSE:
On VSX Gateway, this command must be run from the context of VS0 (run "vsenv" command).
If no argument is specified, then the command will print: "RXX.XX Jumbo Hotfix Accumulator take_N is installed, see skXXXXX".
If "-n" argument is specified, then the command will print only the number of the Take (value "0" means that a reference to the Jumbo Hotfix Accumulator was not found in Check Point Registry).
If "-h" argument is specified, then the command will print the usage help.
For Take 37 and lower
If Jumbo Hotfix Accumulator was installed using Gaia CPUSE:
On VSX Gateway, this command must be run from the context of VS0 (run "vsenv" command).
If no argument is specified, then the command will print: "RXX.XX Jumbo Hotfix Accumulator take_N is installed, see skXXXXX".
If "-n" argument is specified, then the command will print only the number of the Take (value "0" means that a reference to the Jumbo Hotfix Accumulator was not found in Check Point Registry).
If "-h" argument is specified, then the command will print the usage help.
For Take 130 and lower
If Jumbo Hotfix Accumulator was installed using Gaia CPUSE:
On VSX Gateway, this command must be run from the context of VS0 (run "vsenv" command).
If no argument is specified, then the command will print: "RXX.XX Jumbo Hotfix Accumulator take_N is installed, see skXXXXX".
If "-n" argument is specified, then the command will print only the number of the Take (value "0" means that a reference to the Jumbo Hotfix Accumulator was not found in Check Point Registry).
If "-h" argument is specified, then the command will print the usage help.
For Take 99 and lower
If Jumbo Hotfix Accumulator was installed using Gaia CPUSE:
On VSX Gateway, this command must be run from the context of VS0 (run "vsenv" command).
If no argument is specified, then the command will print: "RXX.XX Jumbo Hotfix Accumulator take_N is installed, see skXXXXX".
If "-n" argument is specified, then the command will print only the number of the Take (value "0" means that a reference to the Jumbo Hotfix Accumulator was not found in Check Point Registry).
If "-h" argument is specified, then the command will print the usage help.
