Check Point release fix for CVE-2024-24919 - PATCH NOW.

On behalf of Check Point, a critical CVE-2024-24919 has been released yesterday effecting all customers using either the IPSEC or Mobile Access VPN technologies to enable a crafted attack that can reveal sensitive system data.

Check Point have released a mandatory HotFix that will patch this issue available as well as an FAQ from the links below :

https://support.checkpoint.com/results/sk/sk182337
https://support.checkpoint.com/results/sk/sk182336

https://community.checkpoint.com/t5/General-Topics/Important-security-update-stay-protected-against-VPN-Information/td-p/215310

UPDATE 1 

It is the strong advisory of SEP2 that you patch as soon as possible to avoid malicious actors gaining access to private and potentially critical system data that could further lead to additional network and systems access from your Check Point systems.

This exploit is now in the public domain and is trivial to enable and perform with chances of this exploitation being used to be high.

SEP2 have already received questions on the usage of the IPSEC blade but no Remote Access and whether customers need to patch. As per Check Points own recommendation, if in doubt, patch anyway.

UPDATE 2 

Please be advised the new following recommended steps are now advised to be performed as a priority – released approximately 16:00 GMT

A detailed step-by-step is provided in sk182336.

-Change the password of the LDAP Account Unit
-Reset password of local accounts connecting to VPN with password authentication
-Prevent Local Accounts from connecting to VPN with Password Authentication
-Renew Security Gateway’s Outbound SSL Inspection CA certificate
-Renew Security Gateway’s Inbound SSL Inspection server certificates
-Reset all Gaia OS admin, local users and Expert mode passwords

SEP2 are working on a plan of action for our Wingman customers immediately and will provide notifications through our support helpdesk to all customers once a plan of our activities is ready – you will already have a ticket open in our system to manage our response to this on your behalf.

It is highly advisable that our support only customers review these steps and implement immediately. 

 
For all questions around this release please send via the SEP2 Technical Services helpdesk via [email protected], calling in via 0330 043 5737 or using the SEP2 helpdesk portal located via https://www.sep2.support/ whereby a member of the Technical Services team will respond to you accordingly.

For information, SEP2 have already patched all of our Check Point gateways and have completed the rotation/reset of accounts as per the most up to date guidance from Check Point.

SEP2 are also taking the IOCs that are being made available by Check Point and integrating those into our SEP2.securiy Managed Detection and Response service to complete active threat hunts on those IOCs.