Sophos Releases Hotfixes for Critical Firewall Vulnerabilities

December 20, 2024December 20, 2024

Sophos Releases Critical Hotfixes for Firewall Vulnerabilities

Sophos has recently announced essential hotfixes targeting three significant security vulnerabilities found in its Sophos Firewall products. These flaws could potentially allow remote code execution and privileged system access under specific conditions, making it crucial for users to address them promptly. Among these vulnerabilities, two are rated as critical, highlighting the urgency of the situation. Notably, there is currently no evidence suggesting that these vulnerabilities have been exploited in real-world scenarios.

Overview of the Security Flaws

The vulnerabilities identified by Sophos are as follows:

CVE-2024-12727 (CVSS Score: 9.8): This pre-auth SQL injection vulnerability in the email protection feature could lead to remote code execution, particularly when a specific configuration of Secure PDF eXchange (SPX) is enabled, alongside the firewall operating in High Availability (HA) mode.
CVE-2024-12728 (CVSS Score: 9.8): This weakness stems from a non-random SSH login passphrase for HA cluster initialization, which remains active even after the HA process is completed. This flaw poses a risk of exposing an account with privileged access if SSH is enabled.
CVE-2024-12729 (CVSS Score: 8.8): This post-authentication code injection vulnerability in the User Portal allows authenticated users to execute remote code, posing a substantial security risk.

Impact Assessment and Affected Versions

Sophos has indicated that:

CVE-2024-12727 affects approximately 0.05% of devices.
CVE-2024-12728 impacts about 0.5% of devices.

All three vulnerabilities affect Sophos Firewall versions 21.0 GA (21.0.0) and earlier versions. The hotfixes have been implemented in the following versions:

CVE-2024-12727: Fixed in v21 MR1 and newer, with hotfixes available for various earlier versions.
CVE-2024-12728: Addressed in v20 MR3, v21 MR1, and newer, with similar patch availability for older versions.
CVE-2024-12729: Resolved in v21 MR1 and newer, with hotfixes for previous versions.

How to Verify Hotfix Application

To ensure that the hotfixes have been successfully applied, users should follow these steps:

For CVE-2024-12727: Access the Sophos Firewall console, navigate to Device Management > Advanced Shell, and run the command cat /conf/nest_hotfix_status. The hotfix is confirmed if the value is 320 or above.
For CVE-2024-12728 and CVE-2024-12729: From the Sophos Firewall console, launch the Device Console and execute system diagnostic show version-info. The hotfix is applied if the value is HF120424.1 or later.

Recommended Temporary Workarounds

Until the hotfixes can be fully implemented, Sophos recommends the following temporary measures:

Restrict SSH access to only the dedicated HA link, which should be physically separate.
Reconfigure HA using a sufficiently long and random custom passphrase.
Disable WAN access via SSH.
Ensure that the User Portal and Webadmin are not exposed to WAN.

Conclusion

This disclosure comes shortly after the U.S. government unveiled charges against a Chinese national for exploiting a previous zero-day security vulnerability in Sophos firewalls. Given the critical nature of these newly identified flaws, it is essential for users to act swiftly to secure their systems.

If you found this article insightful, feel free to share your thoughts in the comments below or check out our related articles on cybersecurity measures and best practices. For more updates, follow us on Twitter and LinkedIn for exclusive content.

Additional Resources

Security Flaws Found in Major Open-Source ML Frameworks

December 6, 2024December 12, 2024

Cybersecurity researchers have discovered critical vulnerabilities in popular open-source machine learning frameworks such as MLflow, H2O, PyTorch, and MLeap, potentially allowing remote code execution (RCE). Identified by JFrog, these flaws are part of 22 security issues disclosed last month and target ML clients rather than servers. Notable vulnerabilities include cross-site scripting in MLflow and unsafe deserialization in H2O, both rated with high CVSS scores. JFrog advises organizations to avoid loading untrusted ML models and highlights the importance of understanding model usage to prevent unauthorized access to sensitive ML services. Proactive security measures are essential as AI and ML adoption grows.

Google’s AI Tool Identifies 26 Vulnerabilities in Open Source

December 1, 2024December 1, 2024

Google’s OSS-Fuzz tool has identified 26 vulnerabilities in open-source code, including a medium-severity flaw in OpenSSL, labeled CVE-2024-9143. This out-of-bounds memory write bug, which could lead to application crashes or remote code execution, has been fixed in recent OpenSSL releases. The integration of AI and large language models into OSS-Fuzz has enhanced its fuzzing coverage, uncovering vulnerabilities that might have remained hidden for years. Additionally, Google is transitioning its codebases to memory-safe languages like Rust and implementing security measures in C++ to mitigate risks, reinforcing their commitment to improving open-source security.

New DoubleClickjacking Exploit Bypasses Web Protections

January 1, 2025January 1, 2025

A newly identified vulnerability called DoubleClickjacking poses serious risks to major websites by enabling clickjacking attacks and potential account takeovers. Security researcher Paulos Yibelo highlights this timing-based vulnerability, which exploits a double-click sequence, complicating web security. Unlike traditional clickjacking, DoubleClickjacking manipulates user interfaces by leveraging the time gap between clicks. Attacks typically involve user interaction with a deceptive page, leading to unauthorized permissions. Existing security measures, like X-Frame-Options, are inadequate against this threat. To mitigate risks, website owners are advised to implement client-side prevention strategies and advocate for new browser standards.

Attacks Linked to Major GFI KerioControl Firewall Flaw

January 10, 2025January 10, 2025

GFI KerioControl firewalls are vulnerable to a critical security flaw, CVE-2024-52857, enabling CRLF injection, which has been exploited since December 28. This vulnerability allows attackers to manipulate HTTP response headers, leading to severe risks such as remote code execution, HTTP response splitting attacks, and reflected cross-site scripting (XSS). Security experts urge the nearly 24,000 affected users to apply patches immediately to protect their networks. The flaw was identified by researcher Egidio Romano, with attacks traced back to specific IP addresses in Singapore and Hong Kong. Regular updates and security audits are crucial for safeguarding against such threats.

Critical Security Flaws Fixed in SonicWall and Palo Alto Tools

January 9, 2025January 9, 2025

Palo Alto Networks has released critical patches for its Expedition migration tool, addressing significant security vulnerabilities that could expose sensitive data to authenticated attackers. Key vulnerabilities include SQL injection and cross-site scripting, which could lead to unauthorized access to database contents, files, and system commands. Users are urged to upgrade to versions 1.2.100 and 1.2.101 to mitigate risks. Additionally, SonicWall and Aviatrix have issued security updates for their platforms, addressing vulnerabilities that could allow authentication bypass and arbitrary code execution. Organizations are encouraged to implement these updates promptly to enhance cybersecurity defenses.

Critical OpenWrt Flaw Allows Malicious Firmware Injection

December 13, 2024December 13, 2024

A critical vulnerability, CVE-2024-54143, has been discovered in OpenWrt’s Attended Sysupgrade (ASU) feature, posing a significant risk of malicious firmware distribution. Identified by Flatt Security’s RyotaK on December 4, 2024, it has a CVSS score of 9.3 and allows command injection and SHA-256 hash collisions, enabling attackers to replace legitimate firmware without authentication. OpenWrt has released version 920c8a1 to address this issue. Users are urged to update, review security protocols, and monitor for further updates to protect their devices. The OpenWrt community is actively discussing the vulnerability and its implications.