> Source: [sk182516](https://support.checkpoint.com/results/sk/sk182516) # sk182516 - Check Point Response to CVE-2024-3596 - Blast-RADIUS attack | Property | Value | |----------|-------| | Solution ID | sk182516 | | Date Created | 2024-07-18 | | Last Modified | 2025-06-12 | | Technical Level | General | | Products | Security Gateway, Security Management Server, Spark Firewall (Locally Managed), Multi-Domain Security Management Server | | Versions | R82, R81.20, R81.10 (EOS), R82, R81.20, R81.10.X, R81 (EOS), R81.10 (EOS), R81 (EOS), R81 (EOS), R81.10 (EOS), R81.20, R82 | | OS | Gaia | ## Symptoms - The Blast-RADIUS attack ([CVE-2024-3596](https://www.cve.org/CVERecord?id=CVE-2024-3596)) allows a man-in-the-middle attacker between the Check Point Security Gateway / Management Server and the RADIUS Server to gain unauthenticated Privilege Escalation. ## Cause The Blast-RADIUS attack allows a man-in-the-middle attacker between the RADIUS client and server to forge a valid protocol accept message in response to a failed authentication request. This forgery could give the attacker access to network devices and services without the attacker guessing or brute forcing passwords or shared secrets. The attacker does not learn user credentials. ## Solution This article applies to a login into Check Point products using a RADIUS user. Note - The fix integrated in the Jumbo Hotfix Accumulators obsoletes the previous private Hotfixes. |--------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Login | Required Hotfix | Required Configuration | How to Restore the Default Configuration | | Login to Gaia Portal Login to Gaia Clish | The fix PMTR-107058 is included in: * [Check Point R82](https://support.checkpoint.com/results/sk/sk181127) * [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 89 * [Jumbo Hotfix Accumulator for R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) starting from Take 170 * [Jumbo Hotfix Accumulator for R81](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81/Default.htm) starting from Take 106 You must install this hotfix on these: * Security Gateway / each Cluster Member / Scalable Platform Security Group * Management Server * Log Server * SmartEvent Server | After you install the required Hotfix, configure Gaia Portal and Gaia Clish to ignore all RADIUS "reply" packets without the "Message-Authenticator" field: 1. Connect to the command line on the Gaia Server. 2. Log in to Gaia Clish. 3. Run: `set aaa radius-servers require-message-authenticator yes` 4. Run: `save config` | To restore the default configuration: 1. Connect to the command line on the Gaia Server. 2. Log in to Gaia Clish. 3. Run: `set aaa radius-servers require-message-authenticator no` 4. Run: `save config` | | Login to SmartConsole | The fix PMTR-106894 is included in: * [Jumbo Hotfix Accumulator for R82](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/Default.htm) starting from Take 10 * [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 90 * [Jumbo Hotfix Accumulator for R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) starting from Take 171 You must install this hotfix on these: * Management Server * Log Server * SmartEvent Server | After you install the required Hotfix, configure the server to ignore all RADIUS "reply" packets without the "Message-Authenticator" field: 1. Connect to the command line on the Management Server / Log Server / SmartEvent Server. 2. Log in the Expert mode. 3. Run: `ckp_regedit -a SOFTWARE/CheckPoint/VPN1 require_message_authenticator -n 1` 4. If you followed [sk42184](https://support.checkpoint.com/results/sk/sk42184) to ignore the RADIUS attribute 80, then remove that configuration (the RADIUS attribute 80 must not be ignored). | To restore the default configuration: 1. If needed, follow [sk42184](https://support.checkpoint.com/results/sk/sk42184) to ignore the RADIUS attribute 80. 2. Connect to the command line on the Management Server / Log Server / SmartEvent Server. 3. Log in the Expert mode. 4. Run: `ckp_regedit -d SOFTWARE/CheckPoint/VPN1 require_message_authenticator` | | Login to Mobile Access Portal | The fix PMTR-106894 is included in: * [Jumbo Hotfix Accumulator for R82](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/Default.htm) starting from Take 10 * [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 90 * [Jumbo Hotfix Accumulator for R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) starting from Take 171 You must install this hotfix on these: * Security Gateway * Each Cluster Member * Scalable Platform Security Group | After you install the required Hotfix, configure the server to ignore all RADIUS "reply" packets without the "Message-Authenticator" field: 1. Connect to the command line on the Security Gateway / each Cluster Member / Scalable Platform Security Group. 2. Log in the Expert mode. 3. Run: `ckp_regedit -a SOFTWARE/CheckPoint/VPN1 require_message_authenticator -n 1` 4. If you followed [sk42184](https://support.checkpoint.com/results/sk/sk42184) to ignore the RADIUS attribute 80, then remove that configuration (the RADIUS attribute 80 must not be ignored). 5. In SmartConsole, install the Access Control Policy. | To restore the default configuration: 1. If needed, follow [sk42184](https://support.checkpoint.com/results/sk/sk42184) to ignore the RADIUS attribute 80. 2. Connect to the command line on the Security Gateway / each Cluster Member / Scalable Platform Security Group. 3. Log in the Expert mode. 4. Run: `ckp_regedit -d SOFTWARE/CheckPoint/VPN1 require_message_authenticator` 5. In SmartConsole, install the Access Control Policy. | | Login to Identity Awareness Captive Portal | The fix PMTR-106894 is included in: * [Jumbo Hotfix Accumulator for R82](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/Default.htm) starting from Take 10 * [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 90 * [Jumbo Hotfix Accumulator for R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) starting from Take 171 You must install this hotfix on these: * Security Gateway * Each Cluster Member * Scalable Platform Security Group | After you install the required Hotfix, configure the server to ignore all RADIUS "reply" packets without the "Message-Authenticator" field: 1. Connect to the command line on the Security Gateway / each Cluster Member / Scalable Platform Security Group. 2. Log in the Expert mode. 3. Run: `ckp_regedit -a SOFTWARE/CheckPoint/VPN1 require_message_authenticator -n 1` 4. If you followed [sk42184](https://support.checkpoint.com/results/sk/sk42184) to ignore the RADIUS attribute 80, then remove that configuration (the RADIUS attribute 80 must not be ignored). | To restore the default configuration: 1. If needed, follow [sk42184](https://support.checkpoint.com/results/sk/sk42184) to ignore the RADIUS attribute 80. 2. Connect to the command line on the Security Gateway / each Cluster Member / Scalable Platform Security Group. 3. Log in the Expert mode. 4. Run: `ckp_regedit -d SOFTWARE/CheckPoint/VPN1 require_message_authenticator` 5. In SmartConsole, install the Access Control Policy. | | Remote Access VPN | The fix PMTR-106894 is included in: * [Jumbo Hotfix Accumulator for R82](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/Default.htm) starting from Take 10 * [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 90 * [Jumbo Hotfix Accumulator for R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) starting from Take 171 You must install this hotfix on these: * Security Gateway * Each Cluster Member * Scalable Platform Security Group | After you install the required Hotfix, configure the server to ignore all RADIUS "reply" packets without the "Message-Authenticator" field: 1. Connect to the command line on the Security Gateway / each Cluster Member / Scalable Platform Security Group. 2. Log in the Expert mode. 3. Run: `ckp_regedit -a SOFTWARE/CheckPoint/VPN1 require_message_authenticator -n 1` 4. If you followed [sk42184](https://support.checkpoint.com/results/sk/sk42184) to ignore the RADIUS attribute 80, then remove that configuration (the RADIUS attribute 80 must not be ignored). 5. In SmartConsole, install the Access Control Policy. | To restore the default configuration: 1. If needed, follow [sk42184](https://support.checkpoint.com/results/sk/sk42184) to ignore the RADIUS attribute 80. 2. Connect to the command line on the Security Gateway / each Cluster Member / Scalable Platform Security Group. 3. Log in the Expert mode. 4. Run: `ckp_regedit -d SOFTWARE/CheckPoint/VPN1 require_message_authenticator` 5. In SmartConsole, install the Access Control Policy. | | Log in to Quantum Spark Appliances | The fix SMBGWY-10815 is included in: * [R81.10.17](https://support.checkpoint.com/results/sk/sk183153) and higher * R81.10.15 JHF Build 996004023 and higher | After you install the required firmware image, configure the Quantum Spark Appliance to ignore all RADIUS "reply" packets without the "Message-Authenticator" field: 1. Connect to the command line on the Quantum Spark Appliance. 2. Log in to Gaia Clish. 3. Run: `set global-radius-conf require-message-authenticator true` | To restore the default configuration: 1. Connect to the command line on the Quantum Spark Appliance. 2. Log in to Gaia Clish. 3. Run: `set global-radius-conf require-message-authenticator false` | **For versions that do not contain the hotfix yet, or if you choose not to upgrade, follow one of these mitigations:** * Use other and more secured authentication protocols, such as SAML or LDAPS. or * If RADIUS authentication is still required, then as a best practice: 1. The RADIUS server should be on an isolated internal network with Anti-Spoofing enabled. 2. Follow the "Solution" steps in [sk42184](https://support.checkpoint.com/results/sk/sk42184) to ignore the RADIUS attribute 80. **Revision History** Show / Hide revision history |--------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Date | Description | | 12 Jun 2025 | The fix SMBGWY-10815 for Quantum Spark Appliances is integrated in: * R81.10.17 and higher * R81.10.15 JHF, starting from Build 996004023 | | 27 Jan 2025 | The fix PMTR-106894 is integrated in the R82 Jumbo Hotfix Accumulator starting from Take 10: * For login to SmartConsole * For login to Mobile Access Portal * For login to Identity Awareness Captive Portal * For login to Remote Access VPN | | 25 Nov 2024 | * In the "Product" field, added "Quantum Spark Appliances" * In the list of mitigations, added "For versions that do not contain the hotfix yet" | | 24 Nov 2024 | * In the column "Required Configuration" added the step "If you followed sk42184 to ignore the RADIUS attribute 80, then remove that configuration (the RADIUS attribute 80 must not be ignored)" * Added the column "How to Restore Default Configuration" | | 21 Nov 2024 | * Added the section "Revision History" | | 13 Nov 2024 | The fix PMTR-106894 is integrated in the R81.10 Jumbo Hotfix Accumulator starting from Take 171: * For login to SmartConsole * For login to Mobile Access Portal * For login to Identity Awareness Captive Portal * For login to Remote Access VPN | | 12 Nov 2024 | The fix PMTR-106894 is integrated in the R81.20 Jumbo Hotfix Accumulator starting from Take 90: * For login to SmartConsole * For login to Mobile Access Portal * For login to Identity Awareness Captive Portal * For login to Remote Access VPN | | 10 Nov 2024 | * Added the note "The fix integrated in the Jumbo Hotfix Accumulators obsoletes the previous private Hotfixes." | | 07 Nov 2024 | * For each affected product, added the server type, on which it is necessary to install the Jumbo Hotfix Accumulators * Added the required configuration steps after installing the Jumbo Hotfix Accumulators for the login to SmartConsole, to Mobile Access Portal, to Identity Awareness Captive Portal, and to Remote Access VPN * Added "R82" in the "Version" field * The fix PMTR-107058 for login to Gaia Portal and Gaia Clish is integrated in Check Point R82 | | 22 Oct 2024 | * The fix PMTR-107058 for login to Gaia Portal and Gaia Clish is integrated in the R81 Jumbo Hotfix Accumulator starting from Take 106 | | 14 Oct 2024 | * Improved formatting of the article * The listed Jumbo Hotfix Accumulators provide only the fix PMTR-107058 for login to Gaia Portal and Gaia Clish * Added the required configuration steps after installing the Jumbo Hotfix Accumulators | | 07 Oct 2024 | * The fix PMTR-107058 for login to Gaia Portal and Gaia Clish is integrated in the Jumbo Hotfix Accumulator for R81.10 starting from Take 170 | | 06 Oct 2024 | * The fix PMTR-107058 for login to Gaia Portal and Gaia Clish is integrated in the R81.20 Jumbo Hotfix Accumulator starting from Take 89 | | 22 July 2024 | * In the mitigation steps, added the link to sk42184 | | 18 July 2024 | * First release of this article | --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content