Related
Recommended
JanWeber
UTM Up2Date 9.705 Released

Today we've released UTM 9.705. The release will be rolled out in phases.

  • In phase 1 you can download the update package from our download server
  • In phase 2 we will make it available via our Up2Date servers to all installations

Up2Date Information

News

  • Maintenance Release

Remarks

  • System will be rebooted

Issues Resolved

  • in reply to JustinO'Connor

    My bet (and I don't know this for a fact) -- they issued a hotfix patch of some sort via the pattern up2date system that broke SUM access (possibly the attack vector) -- and now this release fixes it all.  Just a guess, but sort of what happened with XG a couple months ago.  Apparently the bad guys are out there taking new whacks at perimeter security devices, a number of vendors out there have been issuing patches for this sort of vulnerability (unauthorized external access) the past couple of months.

  • in reply to neildonaldson

    Agreed. It is more than a little vexing since I have not been able to access my UTMs for weeks now. Does this mean that they have potentially been compromised and I can't see it?

  • in reply to solae

    up2date Log Snippet:

    2020:09:18-16:20:24 fws01-1 audld[28239]: Using static download server list in HA mode
    2020:09:18-16:20:24 fws01-1 audld[28239]: Deleted lingering download files: u2d-sys-9.704002-705003.tgz.gpg
    2020:09:18-16:20:24 fws01-1 audld[28239]: id="3707" severity="info" sys="system" sub="up2date" name="Successfully synchronized fileset" status="success" action="download" package="sys"

  • OK, next problem.

    If i Upload the Update, then it is visible some Minutes. After that the Update will disappear again..

  • in reply to neildonaldson

    problem here is    9.704 introduced a bug that is  fixed in 9.705  "wireless networks restart continually,"

    so its probably better to apply these at the same time.

    As Steve asks above,  where is the CVE for the UTM vulnerability ?   how serious is it ? 

    judging by the fact its not being rushed out to up2date immediately can we take it that its not so serious ? 

    its pretty poor form to publish  release notes that includes fix for a "remote code execution" bug for webadmin  without any further information  

Unfiltered HTML