Sophos UTM version 9.5 has been available since yesterday morning. All those who, like me, have not yet been offered the update via Up2Date can download it here (301 MB):
http://ftp.astaro.de/UTM/v9/up2date/
The update can then be uploaded manually via the GUI to update the UTM:
As there have always been problems with updates in the past, it is advisable to have a current backup to hand; in the case of virtually installed UTMs, a snapshot should be created as a precaution.
The list of new features is small, but still offers some interesting innovations. I have highlighted the most interesting features for me personally. Unfortunately, there is still no support for Let's Encrypt, which will probably only be available with version 9.6.
Features:
- WAF URL redirection
- WAF configurable TLS version
- WAF true file type detection
- WAF templates
- Sophos Sandstorm configuration of data Center
- Sophos Sandstorm file exceptions
- RESTful API to configure UTM
- AWS CloudWatch Logs Agent
- 64-bit PostgreSQL database
- Email notification for expiring certificates
- Support Access for SSH
- SNMP monitoring of the file system
The list of bug fixes is all the longer for it:
- Fix [NUTM-6503]: [AWS] Migrate to new iaas_* functions
- Fix [NUTM-6646]: [AWS] REST API panic when unlocking unlocked mutex
- Fix [NUTM-6657]: [AWS] Configure AWS profiles via WebAdmin
- Fix [NUTM-6696]: [AWS] Configure CloudWatch support via WebAdmin
- Fix [NUTM-6708]: [AWS] Cloud update not working with conversion deployments
- Fix [NUTM-6814]: [AWS] Rest API is accessible with default password if basic setup has not completed
- Fix [NUTM-6887]: [AWS] REST API panic when inserting into node which is not of type array
- Fix [NUTM-7032]: [AWS] SignalException not handled for SecurityGroupsManagement#update
- Fix [NUTM-7055]: [AWS] queen_configuration_management / aws_resource_management SIGUSR1 handling
- Fix [NUTM-7056]: [AWS] LocalJumpError
- Fix [NUTM-7057]: [AWS] aws_set_sd_check AWS::EC2::Errors::RequestLimitExceeded
- Fix [NUTM-7061]: [AWS] Connection refused – connect(2) for „localhost“ port 4472
- Fix [NUTM-3194]: [Access & Identity] incorrect SSH logins trigger backend authentication requests
- Fix [NUTM-3222]: [Access & Identity] RED10/50: DNS port open on WAN interfaces
- Fix [NUTM-3260]: [Access & Identity] User Portal – IPsec Windows Support
- Fix [NUTM-4149]: [Access & Identity] [RED] Use Sophos NTP pool servers
- Fix [NUTM-4323]: [Access & Identity] NULL pointer deref in red_nl_cmd_tunnel_dump
- Fix [NUTM-4705]: [Access & Identity] Don’t use DNS server from the RED branch as an ISP forwarder
- Fix [NUTM-4852]: [Access & Identity] [RED] flock() on closed filehandle $fhi at /Object/itfhw/red_server.pm line 563.
- Fix [NUTM-4994]: [Access & Identity] STAS creates users even if automatic user creation is disabled
- Fix [NUTM-5134]: [Access & Identity] [OTP] User Portal should recommend Sophos Authenticator
- Fix [NUTM-5925]: [Access & Identity] [RED] prevent configuration for VLAN for Split modes
- Fix [NUTM-6387]: [Access & Identity] HTML5 VNC connection not disconnecting
- Fix [NUTM-6641]: [Access & Identity] [OTP] user can select algorithm for automatic tokens
- Fix [NUTM-6668]: [Access & Identity] [IPsec] L2TP/Cisco policy changes do not update ipsec.conf
- Fix [NUTM-6749]: [Access & Identity] RED15w does not send split DNS traffic over RED tunnel
- Fix [NUTM-5965]: [Basesystem] Sensors command on SG125w doesn’t show hardware fan RPM
- Fix [NUTM-6468]: [Basesystem] BIND Security update (CVE-2016-9131, CVE-2016-9147, CVE-2016-9444)
- Fix [NUTM-6718]: [Basesystem] Update NTP to 4.2.8p9
- Fix [NUTM-6846]: [Basesystem] Linux kernel: ip6_gre: invalid reads in ip6gre_err() (CVE-2017-5897)
- Fix [NUTM-6847]: [Basesystem] BIND Security update (CVE-2017-3135)
- Fix [NUTM-6902]: [Basesystem] Linux kernel: ipv4 keep skb->dst around in presence of IP options (CVE-2017-5970)
- Fix [NUTM-7048]: [Basesystem] Implement software workaround for Intel CPUs
- Fix [NUTM-7067]: [Basesystem] Update OpenSSH to openssh-6.6p1
- Fix [NUTM-7370]: [Basesystem] Bootsplash still shows 9.4 instead of 9.5
- Fix [NUTM-7653]: [Basesystem] Internal SSL certification verification broken
- Fix [NUTM-5658]: [Confd] Stripped restore unaccessable if default internal interface is removed
- Fix [NUTM-3062]: [Email] Mails From mail spool gets quarantined because of „500 Max connection limit reached“ in cssd
- Fix [NUTM-4753]: [Email] Support recipient verification with multiple AD servers
- Fix [NUTM-5350]: [Email] Per user blacklist does not apply until smtp service restarts
- Fix [NUTM-5823]: [Email] Scanner timeout or deadlock for all mails with a .scn attachment
- Fix [NUTM-5892]: [Email] SMTP Exception doesn’t allow ‚&‘ sign within the email address
- Fix [NUTM-6135]: [Email] DLP custom expression doesn’t get triggered if the email body contains certain strings
- Fix [NUTM-6355]: [Email] Email not blocked with expression list
- Fix [NUTM-4474]: [Kernel] Kernel panic – not syncing: Fatal exception in interrupt
- Fix [NUTM-6358]: [Kernel] Kernel: unable to handle kernel NULL pointer dereference at 0000000000000018
- Fix [NUTM-4969]: [Network] Uplink does not recover from error state
- Fix [NUTM-5314]: [Network] 10gb SFP+ flexi module interface fails when under load
- Fix [NUTM-5428]: [Network] Bridge interface can not acquire Dynamic IPv6 address correctly. This interface repeats up/down.
- Fix [NUTM-5831]: [Network] Changing static IP on interface does not take effect immediately
- Fix [NUTM-5861]: [Network] IPv4 static address gets deleted from confd (and WebAdmin) once IPv6 on the same interface fails to obtain dynamic address
- Fix [NUTM-6077]: [Network] Static route on bridge interface disappears after rebooting the UTM
- Fix [NUTM-6807]: [Network] SSL VPN not being redistributed into OSPF
- Fix [NUTM-6901]: [Network] Eth0 is removed while configuring bridge interface
- Fix [NUTM-2420]: [WAF] Remove session management from basic authentication
- Fix [NUTM-5603]: [WAF] Issue with expired lifetime of WAF connections without any hint
- Fix [NUTM-5628]: [WAF] WAF – Provide import and export options for HTTPS domain list
- Fix [NUTM-5640]: [WAF] GUI issue when adding wildcard certificate into Virtual Webservers
- Fix [NUTM-6156]: [WAF] UTM still fails scan for CVE-2016-2183 (SWEET32) after update to 9.408
- Fix [NUTM-6294]: [WAF] WAF – Naming collisions for default profiles
- Fix [NUTM-6522]: [WebAdmin] SMC Test failed after Settings are applied
- Fix [NUTM-6788]: [WebAdmin] Add support for SG105W, SG135W and SG230 in WebAdmin
- Fix [NUTM-7337]: [WebAdmin] Fix appliance picture for SG105w N9
- Fix [NUTM-6467]: [Web] FTP connection fails when using transparent FTP Proxy
- Fix [NUTM-6732]: [Web] Certificate issue with transparent Web Proxy – „unable to get local issuer certificate“
- Fix [NUTM-6876]: [Web] Remove insecure RC4 from default cipher list for Web Protection HTTPS scanning on upgrade to 9.5 or restore of pre-9.5 backup
- Fix [NUTM-7586]: [Web] Chrome v58 and higher fail verification with HTTPS scanning enabled
- Fix [NUTM-5638]: [WiFi] RED15w – integrated AP isn’t shown as pending in transparent / split mode
- Fix [NUTM-5786]: [WiFi] RED15w – if more then one SSID is configured only one is working correctly
- Fix [NUTM-6215]: [WiFi] Issue when roaming between wireless with some clients
- Fix [NUTM-6335]: [WiFi] VLAN fallback not working for integrated AP from RED15w
- Fix [NUTM-6448]: [WiFi] AP55 stuck as inactive
- Fix [NUTM-6511]: [WiFi] AP does not get IP address on 100 Mbit ethernet link
I have already installed the update and have not noticed any problems. The version will be upgraded to 9.500-9.