This, along with the fact that HFA08 fixes the problem with the ASN.1
vulnerability.
The "don't fix it if it ain't broken" approach is a good idea in some areas
of IT; it can be very deadly in the Security area. As long as you do your
homework on what are you patching/upgrading, what new issues you may
introduce, you should be just fine. You don't want to fall behind so far in
a product that someone discovers a flaw from three versions ago, that you
happen to be running, and then get compromised... when you could have
avoided it altogether. The risks of upgrading outweigh the risks of not
upgrading almost every time.
It is wise, however, to give a brand new release (especially of a product)
some "burn-in time" to let those on the cutting-edge find the serious
bugs/issues.
Regards,
Matt
|---------+-------------------------------------------->
| | Simon �stengaard |
| | <[EMAIL PROTECTED]> |
| | Sent by: Mailing list for |
| | discussion of Firewall-1 |
| | <[EMAIL PROTECTED]|
| | KPOINT.COM> |
| | |
| | |
| | 08/11/2004 03:44 AM |
| | Please respond to Mailing list |
| | for discussion of Firewall-1 |
| | |
|---------+-------------------------------------------->
>----------------------------------------------------------------------------------------------|
|
|
| To: [EMAIL PROTECTED] |
| cc:
|
| Subject: Re: [FW-1] Approach to hot fixes?
|
>----------------------------------------------------------------------------------------------|
You should confsider the fact that if you don't update to the lastest
hotfix:
1. You will have to go through all the release notes for unapplied hotfixes
if you change the way you use your firewall.
2. It is always better to be fully patched than "patched if the
vulnerability applies to my situation". Maybe the vulnerability is not
exploitable from the internet in your setup. But an attacker might be able
to exploit it from an already compromised server in your network.
You can almost be certain that the proccess of applying HFA-08 to a HFA-07
installation is more tested by checkpoint QA than the proccess of applying
HFA-08 to a HFA-04 installation or any version prior to HFA-07.
Staying up to date with security patches often breaks functionality. But
i'll guess we'll have to live with that.
/Simon
-----Original Message-----
From: Tom Stala [mailto:[EMAIL PROTECTED]
Sent: 10. august 2004 17:02
To: [EMAIL PROTECTED]
Subject: Re: [FW-1] Approach to hot fixes?
Best practice in my opinion about anything, if it ai'nt broke don't fix it.
If you upgrade to version 8 from 4 you might be braking something that was
working fine.
----- Original Message -----
From: "Shane Presley" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, August 10, 2004 10:20 AM
Subject: [FW-1] Approach to hot fixes?
> Just curious...
>
> Do you regularly keep your firewalls up to date with the Check Point
> hot fixes? Or do you wait for the need? For example I'm currently on
> HFA-04, but HFA-08 is out. I've read the release notes on HFA-08 and
> don't see anything that would immediately impact me, so I don't think
> there's a pressing need to put HFA-08 on it.
>
> But is it a "best practice" to always apply the latest HFA?
>
> Shane
>
> =================================================
> To set vacation, Out-Of-Office, or away messages,
> send an email to [EMAIL PROTECTED]
> in the BODY of the email add:
> set fw-1-mailinglist nomail
> =================================================
> To unsubscribe from this mailing list,
> please see the instructions at
> http://www.checkpoint.com/services/mailing.html
> =================================================
> If you have any questions on how to change your
> subscription options, email
> [EMAIL PROTECTED]
> =================================================
=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [EMAIL PROTECTED]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[EMAIL PROTECTED]
=================================================
=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [EMAIL PROTECTED]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[EMAIL PROTECTED]
=================================================
=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [EMAIL PROTECTED]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[EMAIL PROTECTED]
=================================================
