Sophos IPS and Application Signature Update

These release notes are for Sophos IPS and Application signature updates.

Version 18.22.17
Released on July 15, 2024

Introduction

The Release Note document for IPS and Application signature Database version 18.22.17 includes support for both, the new and the updated Signatures. The following sections describe the release in detail.

Release Information

Upgrade Applicable on: Version 18.22.16

Fixed issues, listed by ID, description, explanation and Workaround.

Appliance Model Details of Changes Module More Details
All Deployments 26 Applications 53 Application Signatures 10 Application categories Application Filter Click Here for details of changes
XGS-87, XGS-87(w), XGS-107, XGS-107(w), XGS-116, XGS-116(w), XGS-126, XGS-126(w), XGS-136, XGS-136(w), XGS-2100, XGS-2300, XGS-3100, XGS-3300, XGS-4300, XGS-4500 XG-86, XG-86(w), XG-106, XG-106(w), XG-115, XG-115(w), XG-125, XG-125(w), XG-135, XG-135(w), XG-210, XG-230, XG-310, XG-330, XG-430, XG-450 SG-105, SG-105(w), SG-115, SG-115(w), SG-125, SG-125(w), SG-135, SG-135(w), SG-210, SG-230, SG-310, SG-330, SG-430, SG-450, SG-550, SG-650 Any virtual deployment with RAM < 24GB 2 Signatures 2 Vulnerabilities 2 IPS Categories IPS Filter Click Here for details of changes
XG-550, XG-650, XG-750 XGS-5500, XGS-6500 Any virtual deployment with RAM >24GB 11 Signatures 5 Vulnerabilities 3 IPS Categories IPS Filter Click Here for details of changes

Report false positives at support@sophos.com along with the application details.

Upgrade Information

Upgrade type: Automatic

Compatibility Annotations: None

Application Signatures

The Sophos Application Filter controls the application traffic depending on the policy configured, by matching them with the Application Signatures. Application Signatures optimize the detection performance and reduces the false alarms.

The table below provides details of signatures included in this release.

This Application Filter Release include Fifty three (53) Application Signatures are updated for Twenty six (26) Applications.

Fixed issues, listed by ID, description, explanation and Workaround.

Application Name Risk Category
Youtube Video Search 3 General Internet
Qzone Website 2 Social Networking
Slingbox Streaming 2 Streaming Media
Skyplayer Streaming 3 Streaming Media
Sciencestage Streaming 3 Streaming Media
Qiyi Com Streaming 2 Streaming Media
NPR Radio Streaming 3 Streaming Media
4shared File Transfer 2 File Transfer
QQ BBS 2 Social Networking
Baidu Video Streaming 3 Streaming Media
Youku Streaming 3 Streaming Media
Crictime Video Streaming 3 Streaming Media
Classroom Spy 5 Proxy and Tunnel
Baidu Music 2 Streaming Media
Tapin Radio 2 Streaming Media
iConnectHere 4 VoIP
MTV Asia 2 Mobile Applications
DNSCrypt 5 Proxy and Tunnel
QQ Website 3 General Internet
Backblaze 3 Storage and Backup
Hungama 2 Streaming Media
Backblaze Personal Backup 1 General Business
MLB 1 General Internet
NHK World TV 1 Streaming Media
QQ WebMail 2 Web Mail
QQ Music Streaming 2 Streaming Media

Terms Explained

Application Name: Name of the Application that can be identified by Sophos Application Filter.

Risk: Describes the level of risk for the application. The levels of risks are described in the table below.

Fixed issues, listed by ID, description, explanation and Workaround.
Risk Level Risk Criteria
1 Very Low
2 Low
3 Medium
4 High
5 Very High

Category: Identifies the category of the Application.

Note: These Application Filtering signatures support prior versions of respective application.

IPS Signatures

The Sophos Intrusion Prevention System shields the network from known attacks by matching the network traffic against the signatures in the IPS Signature Database. These signatures are developed to significantly increase detection performance and reduce the false alarms.

Applicable to: XGS-87, XGS-87(w), XGS-107, XGS-107(w), XGS-116, XGS-116(w), XGS-126, XGS-126(w), XGS-136, XGS-136(w), XGS-2100, XGS-2300, XGS-3100, XGS-3300, XGS-4300, XGS-4500, XG-86, XG-86(w), XG-106, XG-106(w), XG-115, XG-115(w), XG-125, XG-125(w), XG-135, XG-135(w), XG-210, XG-230, XG-310, XG-330, XG-430, XG-450, SG-105, SG-105(w), SG-115, SG-115(w), SG-125, SG-125(w), SG-135, SG-135(w), SG-210, SG-230, SG-310, SG-330, SG-430, SG-450, SG-550, SG-650 and Any virtual deployment with RAM < 24GB

The table below provides details of Signatures included in this release.

This IPS Release includes Two(2) Signatures to address Two(2) Vulnerabilities.

Fixed issues, listed by ID, description, explanation and Workaround.

Name CVE-ID Category Severity
FILE-OFFICE TRUFFLEHUNTER TALOS-2020-1190 attack attempt CVE-2020-13579 file-office 3
SERVER-WEBAPP Nagios XI schedulereport.php CVE-2019-20139 Cross Site Scripting Attempt CVE-2019-20139 server-webapp 3

IPS Signatures

The Sophos Intrusion Prevention System shields the network from known attacks by matching the network traffic against the signatures in the IPS Signature Database. These signatures are developed to significantly increase detection performance and reduce the false alarms.

Applicable to: XG-550, XG-650, XG-750, XGS-5500, XGS-6500 and Any virtual deployment with RAM >24GB

The table below provides details of Signatures included in this release.

This IPS Release includes Eleven(11) Signatures to address Five(5) Vulnerabilities.

Fixed issues, listed by ID, description, explanation and Workaround.

Name CVE-ID Category Severity
FILE-OFFICE TRUFFLEHUNTER TALOS-2020-1190 attack attempt CVE-2020-13579 file-office 3
MALWARE-CNC Linux.Trojan.Coinminer variant outbound connection malware-cnc 1
MALWARE-CNC Win.Coinminer.PyroMineIoT outbound connection malware-cnc 1
MALWARE-CNC Win.Coinminer.Vools variant outbound connection malware-cnc 1
SERVER-WEBAPP Nagios XI schedulereport.php CVE-2019-20139 Cross Site Scripting Attempt CVE-2019-20139 server-webapp 3

Terms Explained

Name: Name of the Signature.

CVE-ID: CVE Identification Number - Common Vulnerabilities and Exposures (CVE) provides reference of CVE Identifiers for publicly known information security vulnerabilities.

Category: Class type according to threat.

Severity: Degree of severity - The levels of severity are described in the table below:

Fixed issues, listed by ID, description, explanation and Workaround.
Severity Level Severity Criteria
1 Critical
2 Major
3 Moderate
4 Minor
5 Warning
Important Notice

Sophos Technologies Pvt. Ltd. has supplied this Information believing it to be accurate and reliable at the time of printing, but is presented without warranty of any kind, expressed or implied. Users must take full responsibility for their application of any products. Sophos Technologies Pvt. Ltd. assumes no responsibility for any errors that may appear in this document. Sophos Technologies Pvt. Ltd. reserves the right, without notice to make changes in product design or specifications. Information is subject to change without notice.

RESTRICTED RIGHTS

©1997 - 2025 Sophos Ltd. All rights reserved.
All rights reserved. Sophos, Sophos logo are trademark of Sophos Technologies Pvt. Ltd.

Corporate Headquarters

Sophos Technologies Pvt. Ltd.
Registered in England and Wales No. 2096520,
The Pentagon, Abingdon Science Park,
Abingdon, OX14 3YP, UK
Web site:
www.sophos.com

© 1997-2025 Sophos Ltd. All Rights Reserved.
Legal
Privacy
Cookies