sk182516 - Check Point Response to CVE-2024-3596 - Blast-RADIUS attack

Check Point Response to CVE-2024-3596 - Blast-RADIUS attack

Please read this important update from Check Point.

Security Alert:

Low

Product

Identity Awareness, Mobile Access / SSL VPN, Multi-Domain Security Management, Security Gateways, Security Management, Spark Firewall

Version

R81 (EOS), R81.10 (EOS), R81.10.X, R81.20, R82

OS

Gaia

Last Modified

2025-06-12

Symptoms

Cause

The Blast-RADIUS attack allows a man-in-the-middle attacker between the RADIUS client and server to forge a valid protocol accept message in response to a failed authentication request. This forgery could give the attacker access to network devices and services without the attacker guessing or brute forcing passwords or shared secrets. The attacker does not learn user credentials.

Solution

This article applies to a login into Check Point products using a RADIUS user.

Note - The fix integrated in the Jumbo Hotfix Accumulators obsoletes the previous private Hotfixes.
Login Required Hotfix Required Configuration How to Restore the Default Configuration
Login
to
Gaia Portal
Login
to
Gaia Clish		 The fix PMTR-107058 is included in:
- Check Point R82
- Jumbo Hotfix Accumulator for R81.20 starting from Take 89
- Jumbo Hotfix Accumulator for R81.10 starting from Take 170
- Jumbo Hotfix Accumulator for R81 starting from Take 106
You must install this hotfix on these:
- Security Gateway / each Cluster Member / Scalable Platform Security Group
- Management Server
- Log Server
- SmartEvent Server		 After you install the required Hotfix, configure Gaia Portal and Gaia Clish to ignore all RADIUS "reply" packets without the "Message-Authenticator" field:
1. Connect to the command line on the Gaia Server.

2. Log in to Gaia Clish.

3. Run:

set aaa radius-servers require-message-authenticator yes

4. Run:

save config		 To restore the default configuration:
1. Connect to the command line on the Gaia Server.

2. Log in to Gaia Clish.

3. Run:

set aaa radius-servers require-message-authenticator no

4. Run:

save config
Login
to
SmartConsole		 The fix PMTR-106894 is included in:
- Jumbo Hotfix Accumulator for R82 starting from Take 10
- Jumbo Hotfix Accumulator for R81.20 starting from Take 90
- Jumbo Hotfix Accumulator for R81.10 starting from Take 171
You must install this hotfix on these:
- Management Server
- Log Server
- SmartEvent Server		 After you install the required Hotfix, configure the server to ignore all RADIUS "reply" packets without the "Message-Authenticator" field:
1. Connect to the command line on the Management Server / Log Server / SmartEvent Server.

2. Log in the Expert mode.

3. Run:

ckp_regedit -a SOFTWARE/CheckPoint/VPN1 require_message_authenticator -n 1

4. If you followed sk42184 to ignore the RADIUS attribute 80, then remove that configuration (the RADIUS attribute 80 must not be ignored).		 To restore the default configuration:
1. If needed, follow sk42184 to ignore the RADIUS attribute 80.

2. Connect to the command line on the Management Server / Log Server / SmartEvent Server.

3. Log in the Expert mode.

4. Run:

ckp_regedit -d SOFTWARE/CheckPoint/VPN1 require_message_authenticator
Login
to
Mobile
Access
Portal		 The fix PMTR-106894 is included in:
- Jumbo Hotfix Accumulator for R82 starting from Take 10
- Jumbo Hotfix Accumulator for R81.20 starting from Take 90
- Jumbo Hotfix Accumulator for R81.10 starting from Take 171
You must install this hotfix on these:
- Security Gateway
- Each Cluster Member
- Scalable Platform Security Group		 After you install the required Hotfix, configure the server to ignore all RADIUS "reply" packets without the "Message-Authenticator" field:
1. Connect to the command line on the Security Gateway / each Cluster Member / Scalable Platform Security Group.

2. Log in the Expert mode.

3. Run:

ckp_regedit -a SOFTWARE/CheckPoint/VPN1 require_message_authenticator -n 1

4. If you followed sk42184 to ignore the RADIUS attribute 80, then remove that configuration (the RADIUS attribute 80 must not be ignored).

5. In SmartConsole, install the Access Control Policy.		 To restore the default configuration:
1. If needed, follow sk42184 to ignore the RADIUS attribute 80.

2. Connect to the command line on the Security Gateway / each Cluster Member / Scalable Platform Security Group.

3. Log in the Expert mode.

4. Run:

ckp_regedit -d SOFTWARE/CheckPoint/VPN1 require_message_authenticator

5. In SmartConsole, install the Access Control Policy.
Login
to
Identity
Awareness
Captive
Portal		 The fix PMTR-106894 is included in:
- Jumbo Hotfix Accumulator for R82 starting from Take 10
- Jumbo Hotfix Accumulator for R81.20 starting from Take 90
- Jumbo Hotfix Accumulator for R81.10 starting from Take 171
You must install this hotfix on these:
- Security Gateway
- Each Cluster Member
- Scalable Platform Security Group		 After you install the required Hotfix, configure the server to ignore all RADIUS "reply" packets without the "Message-Authenticator" field:
1. Connect to the command line on the Security Gateway / each Cluster Member / Scalable Platform Security Group.

2. Log in the Expert mode.

3. Run:

ckp_regedit -a SOFTWARE/CheckPoint/VPN1 require_message_authenticator -n 1

4. If you followed sk42184 to ignore the RADIUS attribute 80, then remove that configuration (the RADIUS attribute 80 must not be ignored).		 To restore the default configuration:
1. If needed, follow sk42184 to ignore the RADIUS attribute 80.

2. Connect to the command line on the Security Gateway / each Cluster Member / Scalable Platform Security Group.

3. Log in the Expert mode.

4. Run:

ckp_regedit -d SOFTWARE/CheckPoint/VPN1 require_message_authenticator

5. In SmartConsole, install the Access Control Policy.
Remote
Access
VPN		 The fix PMTR-106894 is included in:
- Jumbo Hotfix Accumulator for R82 starting from Take 10
- Jumbo Hotfix Accumulator for R81.20 starting from Take 90
- Jumbo Hotfix Accumulator for R81.10 starting from Take 171
You must install this hotfix on these:
- Security Gateway
- Each Cluster Member
- Scalable Platform Security Group		 After you install the required Hotfix, configure the server to ignore all RADIUS "reply" packets without the "Message-Authenticator" field:
1. Connect to the command line on the Security Gateway / each Cluster Member / Scalable Platform Security Group.

2. Log in the Expert mode.

3. Run:

ckp_regedit -a SOFTWARE/CheckPoint/VPN1 require_message_authenticator -n 1

4. If you followed sk42184 to ignore the RADIUS attribute 80, then remove that configuration (the RADIUS attribute 80 must not be ignored).

5. In SmartConsole, install the Access Control Policy.		 To restore the default configuration:
1. If needed, follow sk42184 to ignore the RADIUS attribute 80.

2. Connect to the command line on the Security Gateway / each Cluster Member / Scalable Platform Security Group.

3. Log in the Expert mode.

4. Run:

ckp_regedit -d SOFTWARE/CheckPoint/VPN1 require_message_authenticator

5. In SmartConsole, install the Access Control Policy.
Log in to Quantum Spark Appliances The fix SMBGWY-10815 is included in:
- R81.10.17 and higher
- R81.10.15 JHF Build 996004023 and higher		 After you install the required firmware image, configure the Quantum Spark Appliance to ignore all RADIUS "reply" packets without the "Message-Authenticator" field:
1. Connect to the command line on the Quantum Spark Appliance.

2. Log in to Gaia Clish.

3. Run:

set global-radius-conf require-message-authenticator true		 To restore the default configuration:
1. Connect to the command line on the Quantum Spark Appliance.

2. Log in to Gaia Clish.

3. Run:

set global-radius-conf require-message-authenticator false

For versions that do not contain the hotfix yet, or if you choose not to upgrade, follow one of these mitigations:

or

  1. The RADIUS server should be on an isolated internal network with Anti-Spoofing enabled.
  2. Follow the "Solution" steps in sk42184 to ignore the RADIUS attribute 80.

Revision History
Date Description
12 Jun 2025 The fix SMBGWY-10815 for Quantum Spark Appliances is integrated in:
- R81.10.17 and higher
- R81.10.15 JHF, starting from Build 996004023
27 Jan 2025 The fix PMTR-106894 is integrated in the R82 Jumbo Hotfix Accumulator starting from Take 10:
- For login to SmartConsole
- For login to Mobile Access Portal
- For login to Identity Awareness Captive Portal
- For login to Remote Access VPN
25 Nov 2024 - In the "Product" field, added "Quantum Spark Appliances"
- In the list of mitigations, added "For versions that do not contain the hotfix yet"
24 Nov 2024 - In the column "Required Configuration" added the step "If you followed sk42184 to ignore the RADIUS attribute 80, then remove that configuration (the RADIUS attribute 80 must not be ignored)"
- Added the column "How to Restore Default Configuration"
21 Nov 2024 - Added the section "Revision History"
13 Nov 2024 The fix PMTR-106894 is integrated in the R81.10 Jumbo Hotfix Accumulator starting from Take 171:
- For login to SmartConsole
- For login to Mobile Access Portal
- For login to Identity Awareness Captive Portal
- For login to Remote Access VPN
12 Nov 2024 The fix PMTR-106894 is integrated in the R81.20 Jumbo Hotfix Accumulator starting from Take 90:
- For login to SmartConsole
- For login to Mobile Access Portal
- For login to Identity Awareness Captive Portal
- For login to Remote Access VPN
10 Nov 2024 - Added the note "The fix integrated in the Jumbo Hotfix Accumulators obsoletes the previous private Hotfixes."
07 Nov 2024 - For each affected product, added the server type, on which it is necessary to install the Jumbo Hotfix Accumulators
- Added the required configuration steps after installing the Jumbo Hotfix Accumulators for the login to SmartConsole, to Mobile Access Portal, to Identity Awareness Captive Portal, and to Remote Access VPN
- Added "R82" in the "Version" field
- The fix PMTR-107058 for login to Gaia Portal and Gaia Clish is integrated in Check Point R82
22 Oct 2024 - The fix PMTR-107058 for login to Gaia Portal and Gaia Clish is integrated in the R81 Jumbo Hotfix Accumulator starting from Take 106
14 Oct 2024 - Improved formatting of the article
- The listed Jumbo Hotfix Accumulators provide only the fix PMTR-107058 for login to Gaia Portal and Gaia Clish
- Added the required configuration steps after installing the Jumbo Hotfix Accumulators
07 Oct 2024 - The fix PMTR-107058 for login to Gaia Portal and Gaia Clish is integrated in the Jumbo Hotfix Accumulator for R81.10 starting from Take 170
06 Oct 2024 - The fix PMTR-107058 for login to Gaia Portal and Gaia Clish is integrated in the R81.20 Jumbo Hotfix Accumulator starting from Take 89
22 July 2024 - In the mitigation steps, added the link to sk42184
18 July 2024 - First release of this article

NOTE

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.

Article Properties

Access Level: General

Severity: Low

Status: Approved by TAC

Date Created: 2024-07-18

Last Modified: 2025-06-12