Guest User!

You are not Sophos Staff.

Thread Info
  • Locked Locked
  • Replies 12 replies
  • Subscribers 13 subscribers
  • Views 18743 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos UTM 9.354-004 released

twister5800


Up2Date 9.354004 package description:

Remark:
System will be rebooted

News:
Security Update

Bugfixes:
Fix [36136]: ISC DHCP security update (CVE-2015-8605)
Fix [36201]: Bind Vulnerability CVE-2015-8000
Fix [36266]: OpenSSH security update (CVE-2016-0777, CVE-2016-0778)
Fix [36281]: XSS vulnerability in mod_url_hardening [9.35]
Fix [36282]: XSS vulnerability in mod_avscan [9.35]

RPM packages contained:
modavscan-9.35-11.gf2793ad.rb2.i686.rpm
modurlhardening-9.35-10.g2349e23.rb2.i686.rpm
openssh-6.2p2-0.24.1.1542.gc691ac7.rb5.i686.rpm
chroot-bind-9.9.8_P2-2.gef3615e.rb6.i686.rpm
dhcp-chroot-client-4.3.3_P1-2.g78158b9.rb7.i686.rpm
dhcp-chroot-server-4.3.3_P1-2.g78158b9.rb7.i686.rpm
ep-release-9.354-4.noarch.rpm



This thread was automatically locked due to age.
Parents
  • I have rolled this out to one unit, my SG210. Now I am having issues connecting to firewalls outside of my network. I am seeing a drop inbound now. This all worked flawless for years until now. I use Firefox mostly so I thought is was browser based but it affects multi browsers. It does not work in Firefox and Chrome. It does work in IE11 & Edge. It doesn't seem to matter if I am trying to connect out of SUM or by going directly to the IP address. Thoughts?

    22:43:32 Default DROP TCP CustIPxxx.xxx.xxx.xxx : 4444 → MyIPxxx.xxx.xxx.xxx : 53521 [ACK PSH FIN] len=71 ttl=58 tos=0x00 srcmac=00:17:10:88:e9:c8 dstmac=00:1a:8c:50:2e:45
    22:43:32 Default DROP TCP CustIPxxx.xxx.xxx.xxx : 4444 → MyIPxxx.xxx.xxx.xxx : 53527 [ACK PSH FIN] len=71 ttl=58 tos=0x00 srcmac=00:17:10:88:e9:c8 dstmac=00:1a:8c:50:2e:45
    22:43:34 Default DROP TCP CustIPxxx.xxx.xxx.xxx : 4444 → MyIPxxx.xxx.xxx.xxx : 53598 [ACK SYN] len=52 ttl=58 tos=0x00 srcmac=00:17:10:88:e9:c8 dstmac=00:1a:8c:50:2e:45
    22:43:45 Packet filter rule #13 TCP MYInternalIPxxx.xxx.xxx.xxx : 53656 → CustIPxxx.xxx.xxx.xxx : 4444 [SYN] len=52 ttl=127 tos=0x00 srcmac=a0:d3:c1:16:bf:b9 dstmac=00:1a:8c:50:2e:44
    22:43:47 Default DROP TCP CustIPxxx.xxx.xxx.xxx : 4444 → MyIPxxx.xxx.xxx.xxx : 53615 [ACK SYN] len=52 ttl=58 tos=0x00 srcmac=00:17:10:88:e9:c8 dstmac=00:1a:8c:50:2e:45
    22:43:55 Default DROP TCP CustIPxxx.xxx.xxx.xxx : 4444 → MyIPxxx.xxx.xxx.xxx : 53636 [ACK SYN] len=52 ttl=58 tos=0x00 srcmac=00:17:10:88:e9:c8 dstmac=00:1a:8c:50:2e:45
    22:43:55 Default DROP TCP CustIPxxx.xxx.xxx.xxx : 4444 → MyIPxxx.xxx.xxx.xxx : 53635 [ACK SYN] len=52 ttl=58 tos=0x00 srcmac=00:17:10:88:e9:c8 dstmac=00:1a:8c:50:2e:45
    22:43:55 Default DROP TCP CustIPxxx.xxx.xxx.xxx : 4444 → MyIPxxx.xxx.xxx.xxx : 53633 [ACK SYN] len=52 ttl=58 tos=0x00 srcmac=00:17:10:88:e9:c8 dstmac=00:1a:8c:50:2e:45
Reply
  • I have rolled this out to one unit, my SG210. Now I am having issues connecting to firewalls outside of my network. I am seeing a drop inbound now. This all worked flawless for years until now. I use Firefox mostly so I thought is was browser based but it affects multi browsers. It does not work in Firefox and Chrome. It does work in IE11 & Edge. It doesn't seem to matter if I am trying to connect out of SUM or by going directly to the IP address. Thoughts?

    22:43:32 Default DROP TCP CustIPxxx.xxx.xxx.xxx : 4444 → MyIPxxx.xxx.xxx.xxx : 53521 [ACK PSH FIN] len=71 ttl=58 tos=0x00 srcmac=00:17:10:88:e9:c8 dstmac=00:1a:8c:50:2e:45
    22:43:32 Default DROP TCP CustIPxxx.xxx.xxx.xxx : 4444 → MyIPxxx.xxx.xxx.xxx : 53527 [ACK PSH FIN] len=71 ttl=58 tos=0x00 srcmac=00:17:10:88:e9:c8 dstmac=00:1a:8c:50:2e:45
    22:43:34 Default DROP TCP CustIPxxx.xxx.xxx.xxx : 4444 → MyIPxxx.xxx.xxx.xxx : 53598 [ACK SYN] len=52 ttl=58 tos=0x00 srcmac=00:17:10:88:e9:c8 dstmac=00:1a:8c:50:2e:45
    22:43:45 Packet filter rule #13 TCP MYInternalIPxxx.xxx.xxx.xxx : 53656 → CustIPxxx.xxx.xxx.xxx : 4444 [SYN] len=52 ttl=127 tos=0x00 srcmac=a0:d3:c1:16:bf:b9 dstmac=00:1a:8c:50:2e:44
    22:43:47 Default DROP TCP CustIPxxx.xxx.xxx.xxx : 4444 → MyIPxxx.xxx.xxx.xxx : 53615 [ACK SYN] len=52 ttl=58 tos=0x00 srcmac=00:17:10:88:e9:c8 dstmac=00:1a:8c:50:2e:45
    22:43:55 Default DROP TCP CustIPxxx.xxx.xxx.xxx : 4444 → MyIPxxx.xxx.xxx.xxx : 53636 [ACK SYN] len=52 ttl=58 tos=0x00 srcmac=00:17:10:88:e9:c8 dstmac=00:1a:8c:50:2e:45
    22:43:55 Default DROP TCP CustIPxxx.xxx.xxx.xxx : 4444 → MyIPxxx.xxx.xxx.xxx : 53635 [ACK SYN] len=52 ttl=58 tos=0x00 srcmac=00:17:10:88:e9:c8 dstmac=00:1a:8c:50:2e:45
    22:43:55 Default DROP TCP CustIPxxx.xxx.xxx.xxx : 4444 → MyIPxxx.xxx.xxx.xxx : 53633 [ACK SYN] len=52 ttl=58 tos=0x00 srcmac=00:17:10:88:e9:c8 dstmac=00:1a:8c:50:2e:45
Children
Unfiltered HTML