> Source: [sk106834](https://support.checkpoint.com/results/sk/sk106834)

# sk106834 - Check Point response to PHP Bug #69364 (CVE-2015-4024)

| Property | Value |
|----------|-------|
| Solution ID | sk106834 |
| Date Created | 2015-09-07 |
| Last Modified | 2022-08-01 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- A denial-of-service vulnerability has been reported in the way PHP handles HTTP requests ([PHP Bug #69364](https://bugs.php.net/bug.php?id=69364), [CVE-2015-4024](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4024)).

## Solution

**Notes:**

* All Check Point portals except Mobile Access Portal are open only to internal network (access from the Internet is blocked by default). The risk of an employee of the organization using this CVE to create a DoS attack from the organization's network is very low.
* From Check Point investigation, there is no real threat or public exploit to use this flow.

Check Point provides the following protections:

*

  ### To prevent the malicious PHP traffic through Security Gateway:

  IPS protection "`PHP Multipart Remote Denial of Service`" ([Check Point Reference CPAI-2015-0690](http://www.checkpoint.com/defense/advisories/public/2015/cpai-2015-0690.html)) that was released on 30 June 2015.
  1. Connect with SmartDashboard to Security Management Server / Domain Management Server.   

  2. Go to 'IPS' tab - click on '`Protections`' - in the '`Look for:`' field, paste ***CVE-2015-4024*** and press Enter.   

  3. Right-click on the '`PHP Multipart Remote Denial of Service`' protection - click on '`Details...`' - select the relevant IPS profile - click on '`Edit...`' button.   

  4. Select '`Override IPS Policy with:`' - select either '`Prevent`' or '`Detect`'.   

  5. Click '`OK`' in all windows to apply the changes.   

  6. Save the changes: go to '`File`' menu - click on '`Save`'.   

  7. Install policy onto involved Security Gateways.

  <br />

  <br />

*

  ### To protect your machine with Check Point software:

  [Contact Check Point Support](http://www.checkpoint.com/support-services/contact-support/index.html) to get a Hotfix for this issue.  
  A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
  For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.

  **Hotfix installation instructions for Gaia/SecurePlatform/IPSO OS:**
  1. Hotfix has to be installed on ***Security Gateway / each cluster member / Security Management Server / Multi-Domain Security Management Server***.

     **Notes:**
     * In cluster environment, this procedure must be performed on *all* members of the cluster.
     * In Management HA environment, this procedure must be performed on *both* Management Servers.

     <br />

     <br />

  2. Transfer the hotfix package to the machine (into some directory, e.g., */some_path_to_fix/* ).   

  3. Unpack the hotfix package:

     ***\[Expert@HostName\]# cd /some_path_to_fix/***   
     ***\[Expert@HostName\]# tar -zxvf fw1_wrapper_\<HOTFIX_NAME\>.tgz***   

  4. Install the hotfix:

     ***\[Expert@HostName\]# ./fw1_wrapper_\<HOTFIX_NAME\>***
     **Note:** The script will stop all of Check Point services (*cpstop* ) - read the output on the screen.   

  5. Reboot the machine.

<br />

**Related solutions:**   
[sk170212 - Qualys scanner detects Check Point Security Management and Security Gateway as vulnerable due to PHP version 5.6.x support which is End of Life](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk170212&partition=Internal&product=Quantum)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content