If your firewall experiences Random Hard Lockups on SPLAT

[l0wkey]

We have had two firewalls now showing this behavior on NGX R60 where they will just randomly lock to the point that the OS is completely hung and unresponsive even from the console. After running through STRACE with Checkpoint on BOTH of this issue it was related to Web intelligence / Smartdefense signatures so if you experience this issue immediately disable smart defense and web intelligence and see if your lockups still occur. If they do you will need to contact checkpoint and do a STRACE once the box hangs so they can get the memory registers and such to figure out what signature is causing the lockup.

[RayPesek]

The Apache format string ones are known to be bad and cause lockups. If you have any checked and they do NOT have an underscore before the number, immediately un-check them and push the policy. The good ones have an underscore in the name.

ApacheFormatString1 = bad
ApacheFormatString_1 = good.

I do not remember their exact names.

Ray