Sophos UTM: New update (9.501-5)

by

Sophos has released an update for Sophos UTM 9.5, which fixes quite a few bugs. The update has the version number 9.501-5 and is just under 221 MB in size.

If you are not yet offered the update via the Up2Date service, you can also download it directly here:

At the bottom of the page you will find the update from version 9.500-9 to the current version 9.501-5:

Sophos UTM update

No new features have been added, but 70 bugs have been fixed. As there are unfortunately always problems with updates, a little caution is advised during installation. Extensive testing and an up-to-date backup are advisable. A snapshot can also be helpful for virtual systems.

Bug fixes

Fix [NUTM-6868]: [AWS, REST API] Missing trailing slash in Swagger URLs
Fix [NUTM-6908]: [AWS, REST API] [RESTD] Consistent authentication look and feel
Fix [NUTM-7173]: [AWS, REST API] [RESTD] Selfmon cannot (re)start restd
Fix [NUTM-7633]: [AWS, REST API] Authentication with umlauts and some special characters not working
Fix [NUTM-6727]: [AWS] AWS_CONVERSION_PRE_CHECK_FAILED (Pre-check failed: 127.)
Fix [NUTM-7374]: [AWS] Link to RESTful API documentation
Fix [NUTM-7497]: [AWS] selfmon complains about missing awslogsd during Up2Date
Fix [NUTM-7658]: [AWS] Swagger UI XSS vulnerability
Fix [NUTM-7442]: [Access & Identity, RED] [RED] 3G Failback with RED15(w) not working if DHCP server is shutting down
Fix [NUTM-6504]: [Access & Identity] OpenVPN 2.4.0 deprecated option "tls-remote"
Fix [NUTM-6606]: [Access & Identity] Re-occuring issues with the Sophos UTM Support access
Fix [NUTM-7111]: [Access & Identity] Multiple open vulnerabilities in libvncserver
Fix [NUTM-7157]: [Access & Identity] VPN users not being created when backend AD group is used
Fix [NUTM-7295]: [Access & Identity] HTML5 VPN: Comma not working on Portuguese (Brazil) keyboard
Fix [NUTM-7350]: [Access & Identity] [RED] USB stick E3372 does not work with RED 15
Fix [NUTM-7377]: [Access & Identity] Remote Access tab won't load after selecting the OTP Token tab in the User Portal
Fix [NUTM-7448]: [Access & Identity] SSLVPN: download of configuration for windows should use tls-remote option
Fix [NUTM-7774]: [Access & Identity] HTML5 - Mouse not working on Touch Devices
Fix [NUTM-7874]: [Access & Identity] Openvpn: DoS due to Exhaustion of Packet-ID counter (CVE-2017-7479)
Fix [NUTM-6956]: [Basesystem] Hardware LCD screen: IP address of ports other than eth0 cannot be changed through LCD
Fix [NUTM-7067]: [Basesystem] Update OpenSSH to openssh-6.6p1
Fix [NUTM-7069]: [Basesystem] Linux: CVE-2017-6214: ipv4/tcp: infinite loop in tcp_splice_read()
Fix [NUTM-7626]: [Basesystem] BIND Security update (CVE-2017-3136, CVE-2017-3137)
Fix [NUTM-7646]: [Basesystem] NTP Security update (CVE-2017-6458, CVE-2017-6460)
Fix [NUTM-7742]: [Basesystem] Update Appctrl (4.4.1.21)
Fix [NUTM-6978]: [Confd] Configuration backups do not properly sanitize information
Fix [NUTM-7160]: [Confd] "&" sign in RADIUS secret will be converted into "&"
Fix [NUTM-7636]: [Confd] If changing name in REF_DefaultSuperAdmin 'Admin reset password' page is not presented
Fix [NUTM-3513]: [Email] MIME type filter doesn't detect real mime type
Fix [NUTM-3516]: [Email] POP3 prefetch sometimes stops working
Fix [NUTM-3669]: [Email] SMTP proxy vulnerable by TLS renegotiation (CVE-2011-1473)
Fix [NUTM-3671]: [Email] SPX encrypted messages are vulnerable to access without proper authentication
Fix [NUTM-3677]: [Email] Maildrop locked for account_id
Fix [NUTM-4324]: [Email] Changing Email Protection settings fails with Sandstorm enabled and trial expired
Fix [NUTM-5388]: [Email] Individual SMTP profiles not updated with changed global settings
Fix [NUTM-5545]: [Email] Quarantine report can't be enabled under some circumstances
Fix [NUTM-6379]: [Email] Frequent cssd coredumps
Fix [NUTM-6986]: [Email] Sender blacklist doesn't allow '&' sign within the email address
Fix [NUTM-7220]: [Email] WAF reporting virus found when AV engine on the UTM is updating
Fix [NUTM-7625]: [Email] SMTP DLP expressions do not trigger under specific condition
Fix [NUTM-7722]: [Email] mailbox_size_limit is smaller than message_size_limit in notifier log
Fix [NUTM-3170]: [Network] Time-base access for wireless is dropping ipsec-routes and not creating them again
Fix [NUTM-6992]: [Network] OSPF re-announcing static routes
Fix [NUTM-7044]: [Network] Disable a VLAN associated with the WAN interface breaks the complete communication
Fix [NUTM-7439]: [Network] nf_ct_dns: dropping packet: DNS packet of insuffient length: 25
Fix [NUTM-7395]: [RED] [RED] Split networks/domains fields not shown when editing RED10/15
Fix [NUTM-7491]: [RED] WARNING: CPU: 0 PID: x at net/core/dst.c:293 dst_release+0x30/0x51()
Fix [NUTM-7060]: [Reporting] Search in reports doesn't work if the username contains only numbers
Fix [NUTM-6651]: [Sandboxd] All sandstorm tagged mails get stuck in "Sandstorm scan pending"
Fix [NUTM-4804]: [WAF] Redirect to original requested path after form-based auth
Fix [NUTM-6930]: [WAF] WAF not responding after reboot of the AWS UTM
Fix [NUTM-7178]: [WAF] Segmentation fault in mod_xml2enc for multi-byte charsets
Fix [NUTM-7362]: [WAF] Fix localization strings in Confd
Fix [NUTM-7698]: [WAF] WAF URL redirection and Site path routing can be configured for the same path
Fix [NUTM-7806]: [WAF] WAF - inconsistency with two or more site path routes for '/'
Fix [NUTM-7857]: [WAF] Changing the order of real webservers in the virtual webserver edit form isn't working
Fix [NUTM-6617]: [WebAdmin] Search for Network Definitions breaks in Chrome with over 1000 objects
Fix [NUTM-7652]: [WebAdmin] Not possible to download different SSL VPN User Profiles in one Firefox Session
Fix [NUTM-7870]: [WebAdmin] Comment not displayed for Time Period definition
Fix [NUTM-5794]: [Web] IPv6 fallback to IPv4 doesn't work
Fix [NUTM-6502]: [Web] HTTP Proxy coredumping with EC CA certificate
Fix [NUTM-6532]: [Web] AD Users are prefetched in lowercase letters
Fix [NUTM-6809]: [Web] URL category name "Potiental Unwanted Programs" spelling mistake on sophostest.com
Fix [NUTM-6848]: [Web] HTTPS warn behavior when "Block all content, except..." is selected
Fix [NUTM-6867]: [Web] New httpproxy coredumps after update to v9.411 - ReleaseToCentralCache
Fix [NUTM-7076]: [Web] UTM not updating AD group definition
Fix [NUTM-7167]: [Web] OTP Using AD Backend Membership - duplicates user when capital letters are used in the username
Fix [NUTM-7321]: [Web] Non existent or non proxy users are able to create SSL webfilter exceptions
Fix [NUTM-7367]: [Web] Difference between web_filter templates and default templates in web filter
Fix [NUTM-5612]: [WiFi] Manual channel selection not possible in both bands for SG W appliances

12 thoughts on “Sophos UTM: Neues Update (9.501-5)”

  1. Hallo Nathan
    -> Die meisten Sophos Entwickler arbeiten eher an der XG, anstatt UTM.

    Was ist der Unterschied zu XG, macht es sinn eher eine XG als eine UTM zu kaufen?

    Reply

  2. @Robert, wenn man bei der Firewall Exception bei den Pfaden /OWA/* & /owa/* durch /OWA* & /owa* ersetzt, geht es wieder… Jedoch habe ich keine Ahnung über die Side-Effects…

    Reply

  3. @Nathan: Bei mir funktioniert Outlook Anywhere bzw. Mapi over http und OWA nach dem Update auf die 9.414 noch.

    Gruß
    Christoph

    Reply

  4. @Robert: dann spar Dir auch das Update auf 9.414 – denn hier scheint es die gleichen Probleme zu geben :-(
    Updates bei Sophos sind schon länger mit Vorsicht zu genießen und verzögert zu installieren. Vor ein paar Jahren gab es mal Probleme beim Anzeigen von Live-Logs, da ging dies nur noch über Console. Dies wurde dann Monate später behoben…
    Die meisten Sophos Entwickler arbeiten eher an der XG, anstatt UTM.

    Reply

  5. Hallo,

    die V9.501 ist ein richtiger Griff ins Klo. Nach einem Domain Rejoin funktioniert zwar die Authentifizierung (LDAP und AD) für den WebProxy wieder, Reverseproxy bei der WAF geht nicht mehr. Damit ist OWA von Außen nicht erreichbar. Meldung „Request blocked
    The web application firewall has blocked access to /_zjhrvvup_form for the following reason:
    No signature found“
    kommt.
    Ich frag mich ja, wie die Jungs das fertigbekommen immer wieder neue Bugs reinzubauen und damit funktionierende Systeme lahm legen. Wie testen die bei Sophos denn eigentlich?

    Beim Kunden bleib ich da mal ganz brav auf der 9.4er.

    Hat jemand schon mal ein Rollback auf die 9.50 gemacht?

    Reply

  6. Hi zusammen
    Es gibt doch ein neues für uns Europäer wichtiges Feature in 9.5.x . Bei der Sandstorm kann man jetzt ein europäisches Datencenter festlegen so dass die Datenschutzrichtlinien eingehalten werden können

    Reply

  7. Hallo zusammen,

    als Ergebnis des Updates auf die Version 9.501-5 funktioniert kein AD-SSO mehr und der Zugriff auf einen über die WAF veröffentlichten Exchange per OWA ist nicht möglich.

    siehe https://community.sophos.com/kb/en-us/126819, möglicherweise hilft das hier https://community.sophos.com/products/unified-threat-management/f/hardware-installation-up2date-licensing/93029/after-updating-to-9-501-5-sso-for-http-authentication-failed-and-domain-join-not-working

    Gruß und schönen (Feier-) Tag
    Andreas

    Reply

  9. Hallo Frank,

    die haben ja ziemlich viel im WAF-Bereich gemacht. Werden damit einige Einstellungen aus Deinem Mehrteiler „Aufbau einer kleinen Exchange 2016 Organisation“ einfacher? Oder bist Du noch nicht so weit ;-)?

    Gruß
    Christoph

    Reply

Leave a Comment