New code injection vulnerability in the User Portal and Webadmin of Sophos Firewall

Question

Surprised there is no 'banner' announcement of this in the community forum (I learnt about it from a third party security mailing list). I've said it before but I will say it again, I think it is a major failing of Sophos not to have a security alert mailing list. 
 Details here - https://www.sophos.com/en-us/security-advisories/sophos-sa-20220923-sfos-rce 
 How to check if your XG has been patched - https://support.sophos.com/support/s/article/KB-000044539?language=en_US

JasP · Accepted Answer

A useful update on all this. I was contacted by Yashraj S and asked to check my SMS alerts subscription. I found that I wasn't subscribed to 'Sophos Firewall' alerts. The alerting system has changed a lot since I signed up and it is possible it wasn't even an option when I originally subscribed, confirmed by the fact that I was subscribed to Sophos UTM alerts and we haven't used that product in years. Even better, I also found that you can now also get the alerts by email, which is much more useful for me and exactly what I was asking for in this post. No idea when this was introduced but it seems from the replies in this post that nobody seems to be aware of it. Probably time to stop calling it the SMS alerting service and just call it the 'Alerting Service'! 
 So a big thanks to Yashraj S for looking into this for me and, obviously, I would suggest others check their subscriptions and sign up for emails if they would also be useful. The direct link is https://centralstatus.sophos.com/subscription 
 With regards to being emailed as a Partner, I have never received any Partner emails. I have taken this up with my account manager several times but they haven't been helpful in resolving the issue. It seems to me that when we became Partners, we were never added to the Partner emailing list. As he has been so helpful and seems to have his finger on the pulse, I have asked Yashraj S if there is anything he can do to resolve this or put me in touch with the team responsible for Partner mailings. 
 I still think there should have been a banner alert in the community forums about this.

Sophos · Answer

Hi JasP, 
 Thank you for reaching out and also for your contributions to the Community. 
 We have a number of communications tools that we use to keep our stakeholders informed of security incidents. 
 
 As you&rsquo;ve pointed out, the Security Advisories page as part of the Sophos Trust Center is the primary location to get the latest security alerts. You can also filter and sort across a variety of meta data and product lines. 
 We also use the Security Advisory as a central point to link to other important resources such as relevant KB articles, related CVEs on cve.mitre.org , and other helpful documentation. 
 We also email affected customers and partners directly to ensure they know what to do to ensure they are protected. 
 We also offer an SMS alert service that provides an immediate text notification for important service and security advisories. Anyone can subscribe to it, and we encourage all our customers and partners to use it.

New code injection vulnerability in the User Portal and Webadmin of Sophos Firewall

Top Replies