Sophos XG VPN SSL security is a joke It uses TLS 1.0 with CBC GCM should be the standard default or at least should be available not CBC TLS 1.2/1.3 should be the standard default not 1.0/1.1 This is how a serious security company threat this: https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118518-technote-esa-00.html https://support.umbrella.com/hc/en-us/articles/360033350851-End-of-Life-for-TLS-1-0-1-1- The CBC vulnerability is a vulnerability with TLS v1. This vulnerability has been in existence since early 2004 and was resolved in later versions of TLS v1.1 and TLS v1.2.

Tested it with V18.0 MR1. Works fine now. Tue Apr 14 19:39:14 2020 [10017] ::ffff:Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA Used OpenVPN on iOS with Minimum TLS version set to 1.2.

As far as i know, and i am not a Product manager for XG, there are plans to do so. Stay tuned for the future releases. And keep in mind, it is not as easy to update stuff like that. There are many dependencies. Still work in progress to update those modules.

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

[CRITICAL] Sophos XG SSL VPN Several vulnerabilities

l0rdraiden over 4 years ago

Sophos XG VPN SSL security is a joke

It uses TLS 1.0 with CBC

GCM should be the standard default or at least should be available not CBC
TLS 1.2/1.3 should be the standard default not 1.0/1.1

This is how a serious security company threat this:

The CBC vulnerability is a vulnerability with TLS v1. This vulnerability has been in existence since early 2004 and was resolved in later versions of TLS v1.1 and TLS v1.2.

This thread was automatically locked due to age.

Parents

+1 FloSupport over 4 years ago

Hi All,

This is being tracked under the ID NC-53896, and the fix is scheduled to be included in the upcoming SFOS v18 MR1 release.

Regards,

Florentino
Director, Global Community & Digital Support
Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question, please use the 'Verify Answer' button.

The Award-winning Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel
0 l0rdraiden over 4 years ago in reply to FloSupport

There is nothing in MR1 abour this, I guess we will need to wait to MR2 at least.
Cancel
Vote Up 0 Vote Down

Cancel
+2 LuCar Toni over 4 years ago in reply to l0rdraiden

Tested it with V18.0 MR1. Works fine now.

Tue Apr 14 19:39:14 2020 [10017] ::ffff:Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA

Used OpenVPN on iOS with Minimum TLS version set to 1.2.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel
0 Prism over 4 years ago in reply to LuCar Toni

I can confirm this, It's using TLSv1.2 now.

Tue Apr 14 14:42:43 2020 Control Channel: TLSv1.2, cipher TLSv1.2 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA

But, what about AES-GCM? Will it ever be supported on XG?

Also will the OpenVPN Server on XG get updated someday, or It will only receive patch's?

Thanks!

If a post solves your question use the 'Verify Answer' button.

Ryzen 5600U + I226-V (KVM) v21 EAP @ Home

Sophos ZTNA (KVM) @ Home
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Prism over 4 years ago in reply to LuCar Toni

I can confirm this, It's using TLSv1.2 now.

Tue Apr 14 14:42:43 2020 Control Channel: TLSv1.2, cipher TLSv1.2 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA

But, what about AES-GCM? Will it ever be supported on XG?

Also will the OpenVPN Server on XG get updated someday, or It will only receive patch's?

Thanks!

If a post solves your question use the 'Verify Answer' button.

Ryzen 5600U + I226-V (KVM) v21 EAP @ Home

Sophos ZTNA (KVM) @ Home
Cancel
Vote Up 0 Vote Down

Cancel

Children

+1 LuCar Toni over 4 years ago in reply to Prism

As far as i know, and i am not a Product manager for XG, there are plans to do so. Stay tuned for the future releases.

And keep in mind, it is not as easy to update stuff like that. There are many dependencies. Still work in progress to update those modules.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel