EXIM RCE CVE-2019-15846 URGENT

Question

Hi, this seems to be urgent to me as this is remote exploitable. Any update from Sophos for UTM regarding this? Thanks Joerg 
 
 https://seclists.org/oss-sec/2019/q3/192 
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15846 
 https://www.heise.de/security/meldung/Mailserver-Exim-CERT-Bund-kuendigt-Update-fuer-kritische-Schwachstelle-an-4514414.html

Jaydeep · Accepted Answer

Hello Folks, 
 We have released this KBA yesterday Exim CVE-2019-15846 and Sophos Products This vulnerability is not exploitable on any Sophos products, see the table below for more information.

Product 
 Vulnerable 
 Further information

Sophos XG Firewall 
 No 
 The TLS headers that are used to exploit this vulnerability are stripped by the product before reaching the vulnerable Exim code. *

Sophos UTM 
 No 
 The TLS headers that are used to exploit this vulnerability are stripped by the product before reaching the vulnerable Exim code. *

Sophos Email on Central 
 No 
 Product doesn't utilize Exim

Sophos Email Appliance 
 No 
 Product doesn't utilize Exim

Puremessage for Unix 
 No 
 Product doesn't utilize Exim

Puremessage for Exchange 
 No 
 Product doesn't utilize Exim

Cyberoam 
 No 
 Product doesn't utilize Exim

Reflexion 
 No 
 Product doesn't utilize Exim

* Despite this vulnerability not being exploitable due to the current architecture of the Sophos XG and Sophos UTM products, we do still plan on releasing a patch for Exim on these platforms in an upcoming Maintenance Release.

I hope this clarifies any doubts you have.