> Source: [sk108360](https://support.checkpoint.com/results/sk/sk108360)

# sk108360 - Check Point cluster stability improvement to prevent incorrect change of cluster members state to "Ready"

| Property | Value |
|----------|-------|
| Solution ID | sk108360 |
| Date Created | 2015-10-25 |
| Last Modified | 2023-03-22 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Windows, Gaia |

## Symptoms

- It was demonstrated that by forging CCP packets, it is possible to "confuse" cluster members about the state of peer members and cause denial of service (cluster members could be forced to incorrectly change their state to "Ready").

Credit: Check Point thanks *Christian Port* for responsible disclosure of this issue.

## Cause

This attack is possible if a malicious user ***gains Layer 2 access*** to cluster non-trusted (non-sync) interfaces (whose "Network Objective" in cluster object topology is *not* "Sync").

## Solution

This problem was fixed. The fix is included in:

* [Check Point R80.10](http://supportcontent.checkpoint.com/solutions?id=sk111841)
* [Jumbo Hotfix Accumulator for R77.30](http://supportcontent.checkpoint.com/solutions?id=sk106162) - since *Take_84*
* [Jumbo Hotfix Accumulator for R77.20](http://supportcontent.checkpoint.com/solutions?id=sk101975) - since *Take_180*
* [R77.30 - Security and stability enhancements for Security Gateway (Hotfix #5)](http://supportcontent.checkpoint.com/solutions?id=sk108192)

For **all [supported](http://www.checkpoint.com/support-services/support-life-cycle-policy/enterprise-software-support-timeline/index.html) versions** , Check Point can supply a **Hotfix** . [Contact Check Point Support](http://www.checkpoint.com/services/contact/index.html) to get a Hotfix for this issue.  
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.

**Code was improved:** To increase the cluster security, the CCP packets that can change the cluster state are ignored if they arrive on cluster non-trusted (non-sync) interfaces.

**Hotfix installation instructions for Gaia/SecurePlatform/IPSO OS:**

1. Hotfix has to be installed on ***each cluster member*** .   

2. Transfer the hotfix package to each cluster member (into some directory, e.g., */some_path_to_fix/* ).   

3. Unpack the hotfix package:

   ***\[Expert@HostName\]# cd /some_path_to_fix/***   
   ***\[Expert@HostName\]# tar -zxvf fw1_wrapper_\<HOTFIX_NAME\>.tgz***   

4. Install the hotfix:

   ***\[Expert@HostName\]# ./fw1_wrapper_\<HOTFIX_NAME\>***
   **Note:** The script will stop all of Check Point services (*cpstop* ) - read the output on the screen.   

5. Reboot each cluster member.

**Relevant documentation:**

* ClusterXL Administration Guide ([R75.40](http://supportcontent.checkpoint.com/documentation_download?id=13090), [R75.40VS](http://supportcontent.checkpoint.com/documentation_download?id=16221), [R76](http://supportcontent.checkpoint.com/documentation_download?id=22910), [R77](http://supportcontent.checkpoint.com/documentation_download?id=24800))

**Related solutions:**

* [sk93306 - ATRG: ClusterXL R6x and R7x](http://supportcontent.checkpoint.com/solutions?id=sk93306)
* [sk94849 - Check Point response to "Check Point ClusterXL/CCP issue (DoS)"](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk94849)

Credit: Check Point thanks *Christian Port* for responsible disclosure of this issue.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content