Notice: Sophos UTM 9 Kernel Panic Vulnerability - TCP SACK PANIC - Multiple CVEs

Hi dvaun 

Thank for you reaching out to share this with our Community!

Yes, our team is actively investigating and there should be more information available to provide tomorrow. Please stay tuned.

Regards,

Any new information since "tomorrow"? ;)

Any new information since "tomorrow"? ;)

Yes, please have a look at Sophos Advisory: TCP SACK PANIC kernel vulnerability

Hey EdmundSackbauer 

My apologies for the delayed response!

Yes, we created this thread to provide more information:

• Advisory: TCP SACK PANIC kernel vulnerability

Regards,

I tried to add this command but not working. Can anyone assist me step by step.. Im new here for this command

Add the following line to /var/mdw/etc/iptables/iptable.filter after (:USR_OUTPUT - [0:0]) line at line 29 for UTM v9.603:

• -A INPUT -p tcp -m tcpmss --mss 1:500 -j DROP

Hi Muhammad and welcome to the UTM Community!

You need to use an editor.  Look up the commands for the Linux vi editor and then, as root, enter the following at the command line:

edit /var/mdw/etc/iptables/iptable.filter

Cheers - Bob

https://community.sophos.com/products/unified-threat-management/b/utm-blog/posts/utm-up2date-9-604-released

Thanks for letting us know, Toni.

If the mitigation in the first post here, limiting MSS size, was done, should any of that be undone after upgrading to 9.604?

UPDATE a few minutes later:  After the Up2Date is applied, the lines added to sysctl.conf and iptable.filter are gone, so the answer to my question is apparently "no."

Cheers - Bob

The Up2Date seems to have hung 33 seconds in:

UPDATE a few minutes later: Apparently it completed successfully????

sys-9.603-9.604-1.2.1.tgz (Jul 11 15:31)

Cheers - Bob

Hi Everybody,

unfortunately, I have to ask the same question again, because it has not yet been answered:

If the mitigation in the first post here, limiting MSS size, was done, should any of that be undone after upgrading to 9.604?

In the Update Information stand nothing:

community.sophos.com/.../utm-up2date-9-604-released

In the community article this was the only information about this:

community.sophos.com/.../134237

Note: The changes in /etc/sysctl.conf for both workarounds should be removed once the UTM is updated to v9.604, which includes a permanent fix.

But the MSS where changed in the /var/mdw/etc/iptables/iptable.filter not in the /etc/sysctl.conf !

So it is possible to get a clear simple statement what has to be undone before the update, it is not that if we do something wrong may have hundreds of computer problems!

Sorry but this unnecessary research consumes precious time

Thanks Dirk

Hallo Dirk,

I think the following will show that iptable.filter is corrected to standard in 9.605.

grep 'mss 1\:500' /var/mdw/etc/iptables/iptable.filter

The following will likely indicate that you need to delete the added line in sysctl.conf.

tail -1 /etc/sysctl.conf

Cheers - Bob

Hi Bob,

please excuse me but I do not know what is so difficult to a simple desired answer.
Do i have to remove the iptables changes yes or no?

I think the following will show that iptable.filter is corrected to standard in 9.605.

This means you have installed a new 9.605 an there are the changes by default in the /var/mdw/etc/iptables/iptable.filter, so I have not to remove my changes? Or should I prefer to remove my changes before the update, so it does not fail?

the sysctl.conf must be returned to the original state yes or no.
tail -1 /etc/sysctl.conf # this is no help to show the last line, especially since this is not delivered as described empty

Try and Error are not my ways of working.

Thanks Dirk