Sophos IPS and Application Signature update release notes

Version 18.22.14
Released on July 10, 2024

Introduction

The Release Note document for IPS and Application signature Database version 18.22.14 includes support for both, the new and the updated Signatures. The following sections describe the release in detail.

Release Information

Upgrade Applicable on: Version 18.22.13

Fixed issues, listed by ID, description, explanation and Workaround.

Appliance Model	Details of Changes			Module	More Details
All Deployments	0 Application	0 Application Signature	0 Application category	Application Filter	Click Here for details of changes
XGS-87, XGS-87(w), XGS-107, XGS-107(w), XGS-116, XGS-116(w), XGS-126, XGS-126(w), XGS-136, XGS-136(w), XGS-2100, XGS-2300, XGS-3100, XGS-3300, XGS-4300, XGS-4500 XG-86, XG-86(w), XG-106, XG-106(w), XG-115, XG-115(w), XG-125, XG-125(w), XG-135, XG-135(w), XG-210, XG-230, XG-310, XG-330, XG-430, XG-450 SG-105, SG-105(w), SG-115, SG-115(w), SG-125, SG-125(w), SG-135, SG-135(w), SG-210, SG-230, SG-310, SG-330, SG-430, SG-450, SG-550, SG-650 Any virtual deployment with RAM < 24GB	2 Signatures	1 Vulnerability	1 IPS Category	IPS Filter	Click Here for details of changes
XG-550, XG-650, XG-750 XGS-5500, XGS-6500 Any virtual deployment with RAM >24GB	2 Signatures	1 Vulnerability	1 IPS Category	IPS Filter	Click Here for details of changes

Report false positives at support@sophos.com along with the application details.

Upgrade Information

Upgrade type: Automatic

Compatibility Annotations: None

Application Signatures

The Sophos Application Filter controls the application traffic depending on the policy configured, by matching them with the Application Signatures. Application Signatures optimize the detection performance and reduces the false alarms.

The table below provides details of signature included in this release.

This Application Filter Release include Zero (0) Application Signature is updated for Zero (0) Application.

Fixed issues, listed by ID, description, explanation and Workaround.

Application Name	Risk	Category

Terms Explained

Application Name: Name of the Application that can be identified by Sophos Application Filter.

Risk: Describes the level of risk for the application. The levels of risks are described in the table below.

Fixed issues, listed by ID, description, explanation and Workaround.
Risk Level	Risk Criteria
1	Very Low
2	Low
3	Medium
4	High
5	Very High

Category: Identifies the category of the Application.

Note: These Application Filtering signatures support prior versions of respective application.

IPS Signatures

The Sophos Intrusion Prevention System shields the network from known attacks by matching the network traffic against the signatures in the IPS Signature Database. These signatures are developed to significantly increase detection performance and reduce the false alarms.

Applicable to: XGS-87, XGS-87(w), XGS-107, XGS-107(w), XGS-116, XGS-116(w), XGS-126, XGS-126(w), XGS-136, XGS-136(w), XGS-2100, XGS-2300, XGS-3100, XGS-3300, XGS-4300, XGS-4500, XG-86, XG-86(w), XG-106, XG-106(w), XG-115, XG-115(w), XG-125, XG-125(w), XG-135, XG-135(w), XG-210, XG-230, XG-310, XG-330, XG-430, XG-450, SG-105, SG-105(w), SG-115, SG-115(w), SG-125, SG-125(w), SG-135, SG-135(w), SG-210, SG-230, SG-310, SG-330, SG-430, SG-450, SG-550, SG-650 and Any virtual deployment with RAM < 24GB

The table below provides details of Signatures included in this release.

This IPS Release includes Two(2) Signatures to address One(1) Vulnerability.

Fixed issues, listed by ID, description, explanation and Workaround.

Name	CVE-ID	Category	Severity
FILE-OFFICE Microsoft Office CVE-2024-38021 Remote Code Execution Vulnerability	CVE-2024-38021	file-office	2

IPS Signatures

The Sophos Intrusion Prevention System shields the network from known attacks by matching the network traffic against the signatures in the IPS Signature Database. These signatures are developed to significantly increase detection performance and reduce the false alarms.

Applicable to: XG-550, XG-650, XG-750, XGS-5500, XGS-6500 and Any virtual deployment with RAM >24GB

The table below provides details of Signatures included in this release.

This IPS Release includes Two(2) Signatures to address One(1) Vulnerability.

Fixed issues, listed by ID, description, explanation and Workaround.

Name	CVE-ID	Category	Severity
FILE-OFFICE Microsoft Office CVE-2024-38021 Remote Code Execution Vulnerability	CVE-2024-38021	file-office	2

Terms Explained

Name: Name of the Signature.

CVE-ID: CVE Identification Number - Common Vulnerabilities and Exposures (CVE) provides reference of CVE Identifiers for publicly known information security vulnerabilities.

Category: Class type according to threat.

Severity: Degree of severity - The levels of severity are described in the table below:

Fixed issues, listed by ID, description, explanation and Workaround.
Severity Level	Severity Criteria
1	Critical
2	Major
3	Moderate
4	Minor
5	Warning

Important Notice

Sophos Technologies Pvt. Ltd. has supplied this Information believing it to be accurate and reliable at the time of printing, but is presented without warranty of any kind, expressed or implied. Users must take full responsibility for their application of any products. Sophos Technologies Pvt. Ltd. assumes no responsibility for any errors that may appear in this document. Sophos Technologies Pvt. Ltd. reserves the right, without notice to make changes in product design or specifications. Information is subject to change without notice.

RESTRICTED RIGHTS

©1997 - 2025 Sophos Ltd. All rights reserved.
All rights reserved. Sophos, Sophos logo are trademark of Sophos Technologies Pvt. Ltd.

Corporate Headquarters

Sophos Technologies Pvt. Ltd.
Registered in England and Wales No. 2096520,
The Pentagon, Abingdon Science Park,
Abingdon, OX14 3YP, UK
Web site: www.sophos.com