sk183394 - Check Point response to CVE-2025-32728 - The SSH directive "DisableForwarding" fails to disable "X11 Forwarding" and "Agent Forwarding"

Check Point response to CVE-2025-32728 - The SSH directive "DisableForwarding" fails to disable "X11 Forwarding" and "Agent Forwarding"

Please read this important update from Check Point.

Security Alert:

Symptoms

Specifically, it fails to disable X11 and Agent forwarding, which may allow unintended access under certain configurations.

This issue received the ID CVE-2025-32728.

Solution

Important Notes

Therefore, you must perform this procedure again.

Reason: The Gaia OS uses the SSH configuration from the Red Hat OS. In the Red Hat OS, this parameter line is commented out, and the built-in value of this parameter is "yes" ( see this Red Hat article).

The only correct method to check if the Gaia OS is vulnerable is to use this command as described in the procedure below:

sshd -T -C addr=localhost | grep -i "<Name of Parameter>"

The only correct method to check if a Quantum Spark Appliance (SMB) is vulnerable is to use this command as described in the procedure below:

/pfrm2.0/bin/sshd -T -f /pfrm2.0/etc/sshd_config -C addr=localhost | grep -i " "

This problem was fixed. The fix is included in:

If you choose not to upgrade, follow this workaround procedure:

Procedure

To mitigate this vulnerability, make sure these two parameters are disabled explicitly in your SSH configuration:

  1. Connect to the command line on the Gaia OS server (Security Gateway / each Cluster Member / Security Group / Security Management Server / Log Server / Quantum Spark Appliances (SMB)).
  2. Log in.
  3. If the default shell is Gaia Clish / Gaia gClish, then go to the Expert mode:
    expert
    ```
4. Back up the current SSH configuration file:
   - In versions R81 and higher, R80.40 Jumbo Hotfix Take 83 (and higher), run:
     - On a Security Gateway / each Cluster Member / Security Management Server / Log Server:

```bash
        cp -v /etc/ssh/templates/sshd_config.templ{,_BKP}
        ```
     - On a Security Group (ElasticXL / Maestro / Scalable Chassis):

```bash
        g_all cp -v /etc/ssh/templates/sshd_config.templ{,_BKP}
        ```
   - In versions R80.40 Jumbo Hotfix Take 78 and lower, R80.30SP, R80.30 and lower, run:
     - On a Security Gateway / each Cluster Member / Security Management Server / Log Server:

```bash
        cp -v /etc/ssh/sshd_config{,_BKP}
        ```
     - On a Security Group (ElasticXL / Maestro / Scalable Chassis):

```bash
        g_all cp -v /etc/ssh/sshd_config{,_BKP}
        ```
   - On Quantum Spark Appliances (relevant for all SMB versions):

```bash
      cp -v /pfrm2.0/etc/sshd_config{,_BKP}
      ```
5. Edit the current SSH configuration file:
   - In versions R81 and higher, R80.40 Jumbo Hotfix Take 83 (and higher), run:

```bash
      vi /etc/ssh/templates/sshd_config.templ
      ```
   - In versions R80.40 Jumbo Hotfix Take 78 and lower, R80.30SP, R80.30 and lower, run:

```bash
      vi /etc/ssh/sshd_config
      ```
   - On Quantum Spark Appliances (SMB), run:

```bash
      vi /pfrm2.0/etc/sshd_config
      ```
6. For these two parameters - remove the "#" character in the beginning (if it appears) and configure the value "no":

```bash
    X11Forwarding no
    AllowAgentForwarding no
    ```
7. Save the changes in the file and exit Vi editor.
8. On a Security Group (ElasticXL / Maestro / Scalable Chassis), copy the modified file to all Security Group Members:
   - In versions R81 and higher, run:

```bash
      asg_cp2blades -b all /etc/ssh/templates/sshd_config.templ
      ```
   - In versions R80.30SP and R80.20SP, run:

```bash
      asg_cp2blades -b all /etc/ssh/sshd_config
      ```
   - **This step is not relevant for SMB.**
9. Only in versions R81 and higher, R80.40 Jumbo Hotfix Take 83 and higher - import the changes from the template file into the running Gaia OS configuration:
   - On a Security Gateway / each Cluster Member / Security Management Server / Log Server:

```bash
      /bin/sshd_template_xlate < /config/active
      ```
   - On a Security Group (ElasticXL / Maestro / Scalable Chassis):

```bash
      g_all /bin/sshd_template_xlate < /config/active
      ```
   - **This step is not relevant for SMB.**
10. Restart the SSH server:
    **Important** - Perform this step only from a LOM Card or from a Console port connection.

- The restart of the SSH server will disconnect your SSH connection.
    - If you accidentally made a mistake in the SSH configuration file syntax, then you would not be able to connect over SSH.

Steps:
- On a Security Gateway / each Cluster Member / Security Management Server / Log Server:
   1. Restart the SSH server:

```bash
      service sshd restart
      ```
   2. Make sure the SSH server started and is active:

```bash
      service sshd status
      ```
- On an ElasticXL / Maestro / Scalable Chassis:
   1. Determine which Security Group Member runs the SMO Task:

```bash
      asg stat -i tasks
      ```
   2. Connect to the console port on the Security Group Member that runs the SMO Task.
   3. Log in.
   4. If the default shell is Gaia gClish, then go to the Expert mode:

```bash
      expert
      ```
   5. Restart the SSH server:

```bash
      g_all service sshd restart
      ```
   6. Make sure the SSH server started and is active:

```bash
      g_all service sshd status
      ```
- On Quantum Spark Appliances (SMB), run:

```bash
    killall sshd && /pfrm2.0/bin/sshd -f /pfrm2.0/etc/sshd_config -p 22 -D
    ```
- Make sure the Gaia OS uses the value "no" for the two parameters:

```bash
    sshd -T -C addr=localhost | grep -i "X11Forwarding"
    sshd -T -C addr=localhost | grep -i "AllowAgentForwarding"
    ```
- Commands for SMB:

```bash
    /pfrm2.0/bin/sshd -T -f /pfrm2.0/etc/sshd_config -C addr=localhost | grep -i "X11Forwarding"
    /pfrm2.0/bin/sshd -T -f /pfrm2.0/etc/sshd_config -C addr=localhost | grep -i "AllowAgentForwarding"
    ```

## Article Properties
- **Access Level**: General
- **Severity**: Low
- **Status**: Approved
- **Date Created**: 2025-04-27
- **Last Modified**: 2025-12-18