This is mainly identified by doing a scan on ports: 443, 2083, 2087, & 8443/tcp so if you have a DNAT pointing to your Citrix (NetScaler) Gateway servers, it might impact. The normal scanning will definitely get identified by IPS.
But talking about specific to CVE-2019-19781, I don't have any official information yet. I'll post it as soon as I have something on it.
Systema Gesellschaft für angewandte Datentechnik mbH // Sophos Platinum Partner Sophos Solution Partner since 2003 If a post solves your question, click the 'Verify Answer' link at this post.
Thank for clarification. I was hoping Sophos is using a commercial ruleset too. Best case near up to date like other vendors. The information release from Sophos side is not very good in these cases. Every now and then such a security problem appears. And always the community is asking and the answer isn’t popping up instantly. Is that really only a long way of communication or do they test after the question has appeared. I hope it’s the communication.
Systema Gesellschaft für angewandte Datentechnik mbH // Sophos Platinum Partner Sophos Solution Partner since 2003 If a post solves your question, click the 'Verify Answer' link at this post.
Sophos UTM does protection against CVE-2019-19781 with the latest pattern update in IPS. Please refer to this link: https://lists.astaro.com/ASGV9-IPS-rules.html and the pattern update SID 52512.
