CVE-2022-104 - Where to find the Updates ?

You should follow the advisory: www.sophos.com/.../sophos-sa-20220325-sfos-rce

Do Sophos have a mailing list that can be subscribed to for Sophos CVEs? Keeping track of vulnerabilities is one of our biggest challenges and becomes more and more important every day.

There is a website to keep an eye to it. https://www.sophos.com/en-us/security-advisories

Essentially if there are action to do, you will find notifications likely to be in place. 

I am sure you can see the deficiencies in a website that has to be regularly checked for updates. A mailing list would be a much more useful solution, giving immediate notification. From a security point of view, a firewall is the most exposed part of most people's networks. I want to know about relevant CVEs immediately. Baring in mind the amount of marketing crap that most companies managed to send people, it can't be much of a challenge to setup a mailing list for this.

The report is very nice, but does not advise how you update your XG/XGS or whether the 'hot fixes' haver been applied. In previous versions of XG the hot fix was displayed in the GUI for a number of days, usually until a reboot was performed.

So, how do I tell if there hotfix has been applied to my XG115W?

Ian

Hello rfcat,

Thank you for reaching out.

Take a look at this KB on the command to run to show if the hotfix has been applied.

Regards,

Hello rfcat,

Thank you for reaching out.

Take a look at this KB on the command to run to show if the hotfix has been applied.

Regards,

Hi Emmanuel,

Thank you for the article.

The hot fix has not been applied to my XG115W. The method described in that KB is very cumbersome and does not show which hotfix has not been applied and how many or what was the last hot fix that was applied.

The application of hot fixes automatically is ticked.

Ian

It would be nice if hot fixes showed up in the log. I searched in Sophos Central in Logs with:

Log Subtype = System

Component != DNS

Component != DHCP Server

Component != Central Management

And I can see Anti-virus, ATP, and IPS pattern updates. Would be nice to see hot fixes as well. IN which case, you could generate an automatic report. (Though of course there wouldn't be a report for a hot fix NOT being offered. I would assume a failure to update should be recorded, though.)