How to download SSL VPN client 2.3.18 or higher

All of these scanners are duller than butter knives, Mike.  If you're running your own scans, you can certainly get a statement from Sophos Support that this vulnerability has been eliminated.  If you're using a provider that scans with Nessus, that should also satisfy them for now.  After that,  I suggest that you change providers to get one that knows how to manage and keep track of exceptions as most don't.

Sophos would be foolish to make changes based on this message from Nessus.  The developers can deliver a more-secure tool by patching the modules they know instead of vetting and hardening newer versions all of the time.

In any case, if you're in the same situation as Remouflon (no exceptions allowed by an OpenVPN service to which you want to connect), I don't see how you can avoid doing the upgrades.  Even if Sophos changed the client to a new version, you would have to distribute that, too.

Good luck!

Cheers - Bob

I'm sorry Bob but in this case I'm not with you. It might as well be that all underlying vulnerabilities are effectively being handled by Sophos UTM, but OpenVPN 2.1 was in development from October 2005 until November 2010. So the very last version (2.1.4) is almost 8 years old now. 

As a security company that always preaches to keep software up-to-date this is not practicing what your preach.....

We'll have to agree to disagree, Arno.  They are keeping patches up-to-date and the client does what it needs to do with the UTM.  They don't advertise that it's a client for OpenVPN.  If folks are going to use other OpenVPN servers, they'll need to decide whether they trust the latest OpenVPN client to be used with UTM SSL VPN remote access or if they want to have both the SSL VPN client and the OpenVPN client.

Cheers - Bob