This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Timeline for patching SSL vulnerability (Heartbleed Bug)

Heatbleed Bug (CVE-2014-0160)

Hi

Is there any timeframe for patching this SSL/TLS bug for Astaro Security Gateway V8.
We are on the latest 8.311 (as V8 is an approved appliance for us and V9 is not).

Thanks

Heartbleed Bug
https://news.ycombinator.com/item?id=7548991

This thread was automatically locked due to age.

0 BrucekConvergent over 11 years ago in reply to Jimstigator

Looks like for you guys with errors - you haven't gotten the middle version yet... and they don't jump.

-Jim

Nope... the UTM cluster had both 9.110 and 9.111 ready to install... it still failed.

Guys, installing the 9.110 and 9.111 separately (and in sequence) appears to work fine.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Cancel
0 BrucekConvergent over 11 years ago in reply to BrucekConvergent

Blog was just updated:

UTM Up2Date 9.111 Released – FIX for OpenSSL vulnerability (Heartbleed) | Sophos Blog

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Cancel
0 maygyver over 11 years ago

But where is 9.2 update?

Astaro user since 2001 - Astaro/Sophos Partner since 2008
Cancel
Vote Up 0 Vote Down

Cancel
0 t-work over 11 years ago in reply to barkas

I see why they did 2 days of QA on this.

lol [:D]

They seem to have killed the updates out of the deployment process. After we got the error with the version mismatch and waiting for the "other" update - a third manual search for updates removed the 911 Update again.

Lets wait and see what happens.
Cancel
Vote Up 0 Vote Down

Cancel
0 KT_Sophos over 11 years ago

UTM Up2Date 9.111 Released – FIX for OpenSSL vulnerability (Heartbleed):
UTM Up2Date 9.111 Released – FIX for OpenSSL vulnerability (Heartbleed) | Sophos Blog
Cancel
Vote Up 0 Vote Down

Cancel
0 Jimstigator over 11 years ago in reply to KT_Sophos

Hum.... need the 9.200-11 patch!

-Jim
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 11 years ago
If you don't also see the 9.109-to-9.110 Up2Date, download it at the command line as root by executing the following block of code:
cd /var/up2date/sys
wget ftp.astaro.com/.../u2d-sys-9.109001-110022.tgz.gpg
/sbin/auisys.plx --showdesc

and then install in WebAdmin.

Cheers - Bob
Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 R0n1 over 11 years ago in reply to t-work

lol [:D]

They seem to have killed the updates out of the deployment process. After we got the error with the version mismatch and waiting for the "other" update - a third manual search for updates removed the 911 Update again.

Lets wait and see what happens.

Same here, wait 15 minutes and they appear again [:)]
Cancel
Vote Up 0 Vote Down

Cancel
0 snowcrash_01 over 11 years ago

see here: https://community.sophos.com/products/unified-threat-management/astaroorg/f/52/t/29338
Cancel
Vote Up 0 Vote Down

Cancel
0 BrucekConvergent over 11 years ago in reply to snowcrash_01

Just got an email back from support; they confirmed the issue I reported here about the version mismatch. They say you can just manually install 9.111, skipping 9.110 --- I don't know about that, haven't tried it, don't plan on it.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Cancel