> Source: [sk100431](https://support.checkpoint.com/results/sk/sk100431)
# sk100431 - Important security and stability enhancements for Security Gateway
| Property | Value |
|----------|-------|
| Solution ID | sk100431 |
| Date Created | 2014-04-27 |
| Last Modified | 2023-03-23 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Windows, Linux, Gaia |
## Symptoms
- * A potential stability issue might be triggered by a certain traffic condition when one or more of the following is enabled on the Security Gateway:
* IPS blade
* IPsec Remote Access
* Mobile Access / SSL VPN blade
* SSL Network Extender
* Identify Awareness blade
* HTTPS Inspection
* UserCheck
* Data Leak Prevention blade
* Relevant versions: R75.40VS / R75.45 / R75.46 / R75.47 / R76 / R77 / R77.10.
* Relevant deployments: Security Gateway / Cluster / VSX.
## Solution
This problem was fixed. The fix is included in:
* [Check Point R80.10](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk111841)
* [Check Point R77.30](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk104859)
* [Check Point R77.20](http://supportcontent.checkpoint.com/solutions?id=sk101208)
* [Security Gateway VE Hypervisor Mode R77.10](http://supportcontent.checkpoint.com/solutions?id=sk98867)
* [Check Point R76SP for 61000/41000](http://supportcontent.checkpoint.com/solutions?id=sk94686)
* [Jumbo Hotfix Accumulator for R77.10](http://supportcontent.checkpoint.com/solutions?id=sk98285) - since *Take_24*
* [Jumbo Hotfix Accumulator for R77](http://supportcontent.checkpoint.com/solutions?id=sk96192) - since *Take_7*
* [Jumbo Hotfix Accumulator for R76](http://supportcontent.checkpoint.com/solutions?id=sk96191) - since *Take_10*
* [Jumbo Hotfix Accumulator for R75.47](http://supportcontent.checkpoint.com/solutions?id=sk95827) - since *Take_30*
Check Point recommends to always upgrade to the most recent version ([upgrade Security Gateway](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=435) / [upgrade VSX](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=359) / [upgrade Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=184) / [upgrade Multi-Domain Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=166)).
For **other [supported](http://www.checkpoint.com/support-services/support-life-cycle-policy/index.html) versions** , [Check Point Support](http://www.checkpoint.com/support-services/contact-support/index.html) can supply a **Hotfix**.
Customers should install the following hotfix on their Security Gateways.
Procedure:
----------
**Note:** In cluster environment, this procedure must be performed on all members of the cluster.
* **Show / Hide hotfix installation instructions - Gaia OS using CPUSE (Check Point Update Service Engine)**
We recommend using **[CPUSE](http://supportcontent.checkpoint.com/solutions?id=sk92449#How to work with CPUSE)**to install this hotfix.
**Note:** Hotfix has to be installed on **Security Gateway / each cluster member**.
* **In Gaia Portal:**
1. Connect to the Gaia Portal on your machine.
2. Obtain the lock over the configuration database (click on the lock icon at the top - near '`Sign Out`').
3. Navigate to the '`Software Updates`' - '`Status and Actions`' pane.
4. Go to the '`Updates`' tab to see the published hotfixes available for download.
5. Select the **`Check_Point_Hotfix_`*VERSION*`_sk100431.tgz`** package - right-click on it - click on '`Download`' (this will download the hotfix to your machine).
6. Right-click on the **`Check_Point_Hotfix_`*VERSION*`_sk100431.tgz`** package - click on '`Install`' (this will install the hotfix on the machine and display the installation status).
7. When prompted for reboot (a pop up window appears), confirm to reboot the machine.
* **In Clish:**
1. Connect to Gaia command line (over SSH, or console).
2. Log in to Clish shell.
3. See the list of available packages for download:
`HostName> `**show installer available_packages**
4. Download this hotfix:
`HostName> `**installer download Check_Point_Hotfix_*VERSION*_sk100431.tgz**
5. Check the download progress by repeatedly running this command:
`HostName> `**show installer package_status** *Outputs for example* :
>
> ```
> Check_Point_Hotfix_R77.10_sk100431.tgz - Downloading (2.95 MB/s) - Progress: 6%
> Check_Point_Hotfix_R77.10_sk100431.tgz - Available for install
> ```
6. See the list of available packages for install:
`HostName> `**show installer available_local_packages**
7. Install this hotfix:
`HostName> `**installer install Check_Point_Hotfix_*VERSION*_sk100431.tgz**
8. Check the installation progress by repeatedly running this command:
`HostName> `**show installer package_status** *Outputs for example* :
>
> ```
> Check_Point_Hotfix_R77.10_sk100431.tgz - Installing - Progress: 3%
> Check_Point_Hotfix_R77.10_sk100431.tgz - installed
> ```
9. Machine will be rebooted automatically.
[Contact Check Point Support](http://www.checkpoint.com/services/contact/index.html) for any assistance.
* **Show / Hide hotfix installation instructions - Gaia / SecurePlatform / Linux OS (manual installation in Command Line)**
[Contact Check Point Support](http://www.checkpoint.com/services/contact/index.html) for any assistance.
1. Hotfix has to be installed on **Security Gateway / each cluster member** .
2. Download the relevant hotfix package:
**Note:** In order to download these packages you will need to have a [Software Subscription or Active Support plan](http://www.checkpoint.com/services/techsupport/index.html).
|------------------------------------------|---------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Platform | R75.40VS | R75.47 | R76 | R77 | R77.10 |
| **Gaia OS, SecurePlatform OS, Linux OS** | [Contact Check Point Support](http://www.checkpoint.com/services/contact/index.html) to get this Hotfix | [](http://supportcontent.checkpoint.com/file_download?id=33339) (TGZ) | [](http://supportcontent.checkpoint.com/file_download?id=33341) (TGZ) | [](http://supportcontent.checkpoint.com/file_download?id=33345) (TGZ) | [](http://supportcontent.checkpoint.com/file_download?id=33343) (TGZ) |
For fixes on top of other affected versions, [contact Check Point Support](http://www.checkpoint.com/services/contact/index.html).
3. Transfer the hotfix package to the machine (into some directory, e.g., `/some_path_to_fix/`).
4. Unpack the hotfix package:
**`[Expert@HostName]# cd /some_path_to_fix/`**
**`[Expert@HostName]# tar zxvf Check_Point_Hotfix_`*VERSION*`_Linux_sk100431.tgz`**
5. Install the hotfix:
**`[Expert@HostName]# ./fw1_wrapper_`*HOTFIX_NAME***
Note: The script will stop all of Check Point services (`cpstop`) - read the output on the screen.
6. Reboot the machine.
* **Show / Hide hotfix installation instructions - IPSO OS**
[Contact Check Point Support](http://www.checkpoint.com/services/contact/index.html) for any assistance.
1. Hotfix has to be installed on **Security Gateway / each cluster member** .
2. Download the relevant hotfix package:
**Note:** In order to download these packages you will need to have a [Software Subscription or Active Support plan](http://www.checkpoint.com/services/techsupport/index.html).
|-----------------|---------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Platform | R75.40VS | R75.47 | R76 | R77 | R77.10 |
| **IPSO OS 6.2** | [Contact Check Point Support](http://www.checkpoint.com/services/contact/index.html) to get this Hotfix | [](http://supportcontent.checkpoint.com/file_download?id=33338) (TGZ) | [](http://supportcontent.checkpoint.com/file_download?id=33347) (TGZ) | [](http://supportcontent.checkpoint.com/file_download?id=33349) (TGZ) | [](http://supportcontent.checkpoint.com/file_download?id=33348) (TGZ) |
For fixes on top of other affected versions, [contact Check Point Support](http://www.checkpoint.com/services/contact/index.html).
3. Transfer the hotfix package to the machine (into some directory, e.g., `/some_path_to_fix/`).
4. Unpack the hotfix package:
**`[Expert@HostName]# cd /some_path_to_fix/`**
**`[Expert@HostName]# tar zxvf Check_Point_Hotfix_`*VERSION*`_IPSO6_sk100431.tgz`**
5. Install the hotfix:
**`[Expert@HostName]# ./fw1_wrapper_`*HOTFIX_NAME***
Note: The script will stop all of Check Point services (`cpstop`) - read the output on the screen.
6. Reboot the machine.
* **Show / Hide hotfix installation instructions - Windows OS**
[Contact Check Point Support](http://www.checkpoint.com/services/contact/index.html) for any assistance.
1. Hotfix has to be installed on **Security Gateway / each cluster member** .
2. Download the relevant hotfix package:
**Note:** In order to download these packages you will need to have a [Software Subscription or Active Support plan](http://www.checkpoint.com/services/techsupport/index.html).
|----------------|---------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Platform | R75.40VS | R75.47 | R76 | R77 | R77.10 |
| **Windows OS** | [Contact Check Point Support](http://www.checkpoint.com/services/contact/index.html) to get this Hotfix | [](http://supportcontent.checkpoint.com/file_download?id=33340) (TGZ) | [](http://supportcontent.checkpoint.com/file_download?id=33342) (TGZ) | [](http://supportcontent.checkpoint.com/file_download?id=33346) (TGZ) | [](http://supportcontent.checkpoint.com/file_download?id=33344) (TGZ) |
For fixes on top of other affected versions, [contact Check Point Support](http://www.checkpoint.com/services/contact/index.html).
3. Transfer the hotfix package to the machine (into some directory, e.g., `C:\some_path_to_fix\`).
4. Install the hotfix:
1. Use any archive program (WinZIP, WinRAR, 7-Zip, TUGZip, IZArc) to unpack the **`Check_Point_Hotfix_`*VERSION*`_Win_sk100431.tgz`** file.
2. Open the **`Disk_Images`** folder.
3. Open the **`Disk1`** folder.
4. Right-click on the **`setup.exe`** file - click on '`Run as administrator`'.
Note: The script will stop all of Check Point services (`cpstop`) - read the output on the screen.
5. Reboot the machine.
Additional resolved issues:
---------------------------
Show / Hide the list of additional resolved issues
*Additional* issues resolved by this hotfix:
|----------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------|
| ID | Symptoms | Comments |
| 01354607, 01359114, 01360313, 01360314, 01361087, 01368930, 01375852, 01384279, 01384850 | Enabling URL Filtering blade and Application Control blade might cause Security Gateway to hang. Refer to [sk99027](http://supportcontent.checkpoint.com/solutions?id=sk99027). | - |
| 01375859, 01376023, 01376384, 01402195, 01402203, 01402212, 01402215 | MGCP traffic is randomly dropped with log "`Response to unknown Request. Bad Call-ID`" after upgrade to R76 / R77 / R77.10. Refer to [sk99026](http://supportcontent.checkpoint.com/solutions?id=sk99026). | Not relevant for R75.47 |
| 01362385, 01366990, 01377452, 01379645, 01396795, 01402500, 01404287 | URL Filtering drops the traffic with an "`Internal Error`" log. Refer to [sk98743](http://supportcontent.checkpoint.com/solutions?id=sk98743). | Relevant only for R75.47 |
| 01396595, 01396692, 01397545, 01398410, 01404169, 01404182, 01404184, 01404197 | A redirect to the UserCheck page can cause the fwk0 process to crash, which causes traffic outage. Refer to [sk100505](http://supportcontent.checkpoint.com/solutions?id=sk100505). | - |
| 01341419, 01364227, 01368057, 01368058, 01369917, 01370962, 01375738, 01380193, 01391855, 01403937 | When URL Filtering or Identity Awareness is enabled, trying to reach HTTPS sites can sometimes cause the Security Gateway to crash. Refer to [sk98935](http://supportcontent.checkpoint.com/solutions?id=sk98935). | - |
| 01345138, 01371610, 01381090, 01384237, 01404282, 01404655, 01405997 | Upgrade from R76 with enabled Mobile Access blade and Push Notifications to R77.10 can cause the operating system of the Security Gateway to freeze. Refer to [sk101062](http://supportcontent.checkpoint.com/solutions?id=sk101062). | - |
---
# Agent Instructions
This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.
## Navigating This Knowledge Base
- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content