This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

UTM Version 9.352-6 and 9.318-5 released (Do not install!!)

DO NOT INSTALL - THE UPDATES ARE FAULTY (Read this thread through!)


· Security Update

· System will be rebooted

36115 WebAdmin reflective XSS Vulnerability
36126 OpenSSL security update 1.0.1q

This thread was automatically locked due to age.
  • Hi all:

    First of all, many thanks for pointing our attention to this issue.

    We had been able to reproduce and identify the source of the issue in the so-called Flow Monitor and will provide a fix in a future version.

    Sascha Rudolph
    Senior Software Engineer


    Sascha Rudolph
    Senior Software Engineer, NSG

  • eremit said:
    We had been able to reproduce and identify the source of the issue in the so-called Flow Monitor

    So called Flow Monitor??? This is the product you are selling... and it is called flow monitor... What do you mean so called flow monitor. All you guys did was apply an SSL patch and fixed a vulnerability that specifically affected webadmin. All you had to do was QA the daemons that are affected by SSL connections and webadmin itself. Anyone using the UTM can tell you what to test without even knowing all the other dependencies.  

    1. Test webadmin.

    2. Test WAF.

    3. Test SMTP.

    4. Any other dependencies.

    You guys didn't even test webadmin??? Is anybody doing QA or someone downloaded the binary and changed it to an rpm and hoped it will work. Two separate trees same problem??? Now a casual contact your reseller/ don't know when it will be fixed??? Really strange what is going on at sophos [:^)]

  • "You guys didn't even test webadmin???"... My thoughts exactly Billybob.

    Sascha indicates he saw no problems with FRESH install. And this helps probably 99% of us how?

    I'm gonna go ahead and throw this out there, maybe QA an UPDATE install too. Ya think?

     “Stay paranoid, my friends.”

  • Hi GetParanoid,

    with fresh installations i get the same issues for the actual firmware....

    Cheers Andreas


    UTM SCE/SCA | Endpoint SCE

Reply Children
No Data