This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Timeline for patching SSL vulnerability (Heartbleed Bug)

Heatbleed Bug (CVE-2014-0160)

Hi

Is there any timeframe for patching this SSL/TLS bug for Astaro Security Gateway V8.
We are on the latest 8.311 (as V8 is an approved appliance for us and V9 is not).

Thanks

Heartbleed Bug
https://news.ycombinator.com/item?id=7548991

This thread was automatically locked due to age.

Parents

0 snowcrash_01 over 11 years ago

see here: https://community.sophos.com/products/unified-threat-management/astaroorg/f/52/t/29338
Cancel
Vote Up 0 Vote Down

Cancel
0 BrucekConvergent over 11 years ago in reply to snowcrash_01

Just got an email back from support; they confirmed the issue I reported here about the version mismatch. They say you can just manually install 9.111, skipping 9.110 --- I don't know about that, haven't tried it, don't plan on it.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 BrucekConvergent over 11 years ago in reply to snowcrash_01

Just got an email back from support; they confirmed the issue I reported here about the version mismatch. They say you can just manually install 9.111, skipping 9.110 --- I don't know about that, haven't tried it, don't plan on it.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Alvin over 11 years ago in reply to BrucekConvergent

I Manually Download and Uploaded the 3 files before the Up2Date "proceeded"

Have to admit it was a mess but somehow it "started" installing when "3rd" file is uploaded.

u2d-sys-9.109001-110022.tgz.gpg (Third File Manually)
u2d-sys-9.110022-111007.tgz.gpg (Second File Manualy)
u2d-sys-9.111002-111007.tgz.gpg (First File Auto Up2Date)

1) Changed the Password for my SSL VPN Username.

2) How to Re-Generate Certificates? Is there a step by step guide?

3) Downloading the SSL VPN Client for windows to install.
Cancel
Vote Up 0 Vote Down

Cancel
0 Jimstigator over 11 years ago in reply to Alvin

The 9.200-11 to 9.201 update is in the FTP.

ftp://ftp.astaro.com/UTM/v9/up2date/
Cancel
Vote Up 0 Vote Down

Cancel
0 Ákos Szalkai over 11 years ago in reply to Alvin

How to Re-Generate Certificates? Is there a step by step guide?

There is a pretty useful guide for this and all other steps, in order: http://www.sophos.com/en-us/support/knowledgebase/120851.aspx
Cancel
Vote Up 0 Vote Down

Cancel
0 wiLLow over 11 years ago in reply to Ákos Szalkai

there is a pretty useful guide for this and all other steps, in order: Heartbleed: Recommended steps for UTM

wooohooo, thanks!! :-)
Cancel
Vote Up 0 Vote Down

Cancel
0 BrucekConvergent over 11 years ago in reply to Alvin

I Manually Download and Uploaded the 3 files before the Up2Date "proceeded"

Have to admit it was a mess but somehow it "started" installing when "3rd" file is uploaded.

u2d-sys-9.109001-110022.tgz.gpg (Third File Manually)
u2d-sys-9.110022-111007.tgz.gpg (Second File Manualy)
u2d-sys-9.111002-111007.tgz.gpg (First File Auto Up2Date)

1) Changed the Password for my SSL VPN Username.

2) How to Re-Generate Certificates? Is there a step by step guide?

3) Downloading the SSL VPN Client for windows to install.

Guys, read this KB article and all will become clear [:)]
http://www.sophos.com/en-us/support/knowledgebase/120851.aspx

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Cancel