Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 18 replies
  • Subscribers 2 subscribers
  • Views 7230 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

9.313003 GA Released

Crisman
Up2Date 9.313003 package description:

Remark:
 System will be rebooted

News:
 Security Update

Bugfixes:
 Fix [35213]: OpenSSL security update 1.0.1o
 Fix [35235]: RED: Update OpenSSL

RPM packages contained:
 libaio-0.3.109-0.1.46.1252.g512b2a5.rb1.i686.rpm 
 libopenssl1_0_0-1.0.1k-0.200389443.g74553b7.rb3.i686.rpm
 libopenssl1_0_0_httpproxy-1.0.1k-0.200389443.g74553b7.rb3.i686.rpm
 libreadline5-5.2-147.22.1.1850.g512b2a5.rb1.i686.rpm
 bash-3.2-147.22.1.1850.g512b2a5.rb1.i686.rpm     
 mdadm-3.2.6-0.19.9.1251.g512b2a5.rb1.i686.rpm     
 openssl-1.0.1k-0.200389443.g74553b7.rb3.i686.rpm 
 red-firmware2-4013-0.g85b9aa7.noarch.rpm         
 timezone-2014g-0.3.1.1849.g512b2a5.rb1.i686.rpm   
 ep-chroot-httpd-9.30-22.g3d9de75.noarch.rpm       
 chroot-httpd-2.4.12-1.g70fba59.rb1.i686.rpm       
 ep-release-9.313-3.noarch.rpm


This thread was automatically locked due to age.
  • 0
    Updated to 9.313-3 and since then, i have problem with tags in Web Protection/Filtering Options/Exceptions.

    I have Websites defined as CIDR Ranges and one with IP.(Optimal Firewall Configuration - GoToMeeting) in one tag. 
    This tag is in an rule in exceptions (ssl-scanning). 

    Since 9.313-3 the exception is only working with IP-address as URL rule.
  • 0
    Up2Date 9.313003 package description:
    Bugfixes:
     Fix [35213]: OpenSSL security update 1.0.1o
     


    On my System: 

    sgtest:/ # cat /etc/version
     9.313003
    sgtest:/ # openssl version
    OpenSSL 1.0.1k 8 Jan 2015


    So, there is obviously not running 1.0.1o but 1.0.1k. Is this a bug in the release notes, or did I miss anything?

    Edit: 
    Additionaly, below in the Packets Lists, is also a the k-Version Package of the OpenSSL RPM, so it seems to be an Error in the Release notes from my point of View.
    openssl-1.0.1k-0.200389443.g74553b7.rb3.i686.rpm 

    Please send me Spam gueselkuebel@sg-utm.also-solutions.ch

  • 0 in reply to HuberChristian
    On my System:  

    sgtest:/ # cat /etc/version

     9.313003

    sgtest:/ # openssl version

    OpenSSL 1.0.1k 8 Jan 2015


    So, there is obviously not running 1.0.1o but 1.0.1k. Is this a bug in the release notes, or did I miss anything?

    Edit: 
    Additionaly, below in the Packets Lists, is also a the k-Version Package of the OpenSSL RPM, so it seems to be an Error in the Release notes from my point of View.


    Excellent remark!
  • 0
    Open ssl addressed, wonderful, but when will the bind risk be addressed?
  • 0
    when will the bind risk be addressed?
    Can you be more specific?  Maybe a CVE?  Thanks.
    __________________
    ACE v8/SCA v9.3

    ...still have a v5 install disk in a box somewhere.

    http://xkcd.com
    http://www.tedgoff.com/mb
    http://www.projectcartoon.com/cartoon/1
  • 0
    Scott, I think it may be time again for your lecture on why Sophos and others patch things like openssl instead of changing to a new version.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to Scott_Klassen
    Can you be more specific?  Maybe a CVE?  Thanks.


    Original release date: July 08, 2015

    The Internet Systems Consortium (ISC) has released security updates to address a vulnerability in BIND. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service condition.

    Updates available include:

    BIND 9-version 9.9.7-P1 
    BIND 9-version 9.10.2-P2 
    Users and administrators are encouraged to review ISC Knowledge Base Article AA-01267 and apply the necessary updates.
  • 0
    @Jim:  Thanks, did some further research on CVE-2015-4620.  This is only an issue when using DNSSEC validation, which is turned off by default and not used by many customers.  The fix might be in 9.314, which should be released this next week.  If you have a paid license, open up a support case and they should be able to tell you for certain, with a little digging.  The more paid users who open up cases on an issue, the higher priority the fix gets.  [:)]
    __________________
    ACE v8/SCA v9.3

    ...still have a v5 install disk in a box somewhere.

    http://xkcd.com
    http://www.tedgoff.com/mb
    http://www.projectcartoon.com/cartoon/1
Unfiltered HTML