Sophos IPS and Application Signature Update

These release notes are for Sophos IPS and Application signature updates.

Version 18.23.07
Released on March 6, 2025

Introduction

The Release Note document for IPS and Application signature Database version 18.23.07 includes support for both, the new and the updated Signatures. The following sections describe the release in detail.

Release Information

Upgrade Applicable on: Version 18.23.06

Fixed issues, listed by ID, description, explanation and Workaround.

Appliance Model Details of Changes Module More Details
All Deployments 24 Applications 40 Application Signatures 5 Application categories Application Filter Click Here for details of changes
XGS-87, XGS-87(w), XGS-107, XGS-107(w), XGS-116, XGS-116(w), XGS-126, XGS-126(w), XGS-136, XGS-136(w), XGS-2100, XGS-2300, XGS-3100, XGS-3300, XGS-4300, XGS-4500 XG-86, XG-86(w), XG-106, XG-106(w), XG-115, XG-115(w), XG-125, XG-125(w), XG-135, XG-135(w), XG-210, XG-230, XG-310, XG-330, XG-430, XG-450 SG-105, SG-105(w), SG-115, SG-115(w), SG-125, SG-125(w), SG-135, SG-135(w), SG-210, SG-230, SG-310, SG-330, SG-430, SG-450, SG-550, SG-650 Any virtual deployment with RAM < 24GB 4 Signatures 3 Vulnerabilities 2 IPS Categories IPS Filter Click Here for details of changes
XG-550, XG-650, XG-750 XGS-5500, XGS-6500 Any virtual deployment with RAM >24GB 14 Signatures 11 Vulnerabilities 3 IPS Categories IPS Filter Click Here for details of changes

Report false positives at support@sophos.com along with the application details.

Upgrade Information

Upgrade type: Automatic

Compatibility Annotations: None

Application Signatures

The Sophos Application Filter controls the application traffic depending on the policy configured, by matching them with the Application Signatures. Application Signatures optimize the detection performance and reduces the false alarms.

The table below provides details of signatures included in this release.

This Application Filter Release include Forty (40) Application Signatures are updated for Twenty four (24) Applications.

Fixed issues, listed by ID, description, explanation and Workaround.

Application Name Risk Category
Livestream Website 3 Streaming Media
VeohTV Streaming 2 Streaming Media
Streamaudio Streaming 2 Streaming Media
DLS-Mon 1 Network Services
SRC 1 Network Services
AT-NBP 1 Network Services
AT-3 1 Network Services
AT-ECHO 1 Network Services
AT-5 1 Network Services
AT-ZIS 1 Network Services
AT-7 1 Network Services
AT-8 1 Network Services
914c/g 1 Network Services
ANET 1 Network Services
Vmpwscs 1 Network Services
SoftPC 1 Network Services
CAIlic 1 Network Services
Dropbox Base 3 Storage and Backup
Workable 1 General Business
WeTransfer Base 3 File Transfer
WeTransfer Download 3 File Transfer
WeTransfer Upload 3 File Transfer
6sense 1 General Business
Pandora.TV Streaming 3 Streaming Media

Terms Explained

Application Name: Name of the Application that can be identified by Sophos Application Filter.

Risk: Describes the level of risk for the application. The levels of risks are described in the table below.

Fixed issues, listed by ID, description, explanation and Workaround.
Risk Level Risk Criteria
1 Very Low
2 Low
3 Medium
4 High
5 Very High

Category: Identifies the category of the Application.

Note: These Application Filtering signatures support prior versions of respective application.

IPS Signatures

The Sophos Intrusion Prevention System shields the network from known attacks by matching the network traffic against the signatures in the IPS Signature Database. These signatures are developed to significantly increase detection performance and reduce the false alarms.

Applicable to: XGS-87, XGS-87(w), XGS-107, XGS-107(w), XGS-116, XGS-116(w), XGS-126, XGS-126(w), XGS-136, XGS-136(w), XGS-2100, XGS-2300, XGS-3100, XGS-3300, XGS-4300, XGS-4500, XG-86, XG-86(w), XG-106, XG-106(w), XG-115, XG-115(w), XG-125, XG-125(w), XG-135, XG-135(w), XG-210, XG-230, XG-310, XG-330, XG-430, XG-450, SG-105, SG-105(w), SG-115, SG-115(w), SG-125, SG-125(w), SG-135, SG-135(w), SG-210, SG-230, SG-310, SG-330, SG-430, SG-450, SG-550, SG-650 and Any virtual deployment with RAM < 24GB

The table below provides details of Signatures included in this release.

This IPS Release includes Four(4) Signatures to address Three(3) Vulnerabilities.

Fixed issues, listed by ID, description, explanation and Workaround.

Name CVE-ID Category Severity
MISC ROWSER-PLUGINS SAP 3D Visual Enterprise Viewer 3DM File Buffer Overflow misc 1
MISC ROWSER-PLUGINS SAP 3D Visual Enterprise Viewer 3DM File Buffer Overflow misc 4
SERVER-APACHE Apache Traffic Control SQL Injection Vulnerability CVE-2024-45387 server-apache 1

IPS Signatures

The Sophos Intrusion Prevention System shields the network from known attacks by matching the network traffic against the signatures in the IPS Signature Database. These signatures are developed to significantly increase detection performance and reduce the false alarms.

Applicable to: XG-550, XG-650, XG-750, XGS-5500, XGS-6500 and Any virtual deployment with RAM >24GB

The table below provides details of Signatures included in this release.

This IPS Release includes Fourteen(14) Signatures to address Eleven(11) Vulnerabilities.

Fixed issues, listed by ID, description, explanation and Workaround.

Name CVE-ID Category Severity
PROTOCOL-SNMP Cisco IOS SNMP OID parsing buffer overflow attempt CVE-2025-20173 protocol-snmp 1
PROTOCOL-SNMP Cisco IOS SNMP OID parsing buffer overflow attempt CVE-2025-20174 protocol-snmp 1
PROTOCOL-SNMP Cisco IOS SNMP OID parsing buffer overflow attempt CVE-2025-20175 protocol-snmp 1
PROTOCOL-SNMP Cisco IOS SNMP OID parsing buffer overflow attempt CVE-2025-20176 protocol-snmp 1
PROTOCOL-SNMP Cisco IOS SNMP OID parsing denial of service attempt CVE-2025-20169 protocol-snmp 1
PROTOCOL-SNMP Cisco IOS SNMP OID parsing denial of service attempt CVE-2025-20171 protocol-snmp 1
SERVER-APACHE Apache Traffic Control SQL Injection Vulnerability CVE-2024-45387 server-apache 1
SERVER-WEBAPP Microsoft .NET Framework information disclosure attempt CVE-2024-29059 server-webapp 2
SERVER-WEBAPP Reprise License Manager Actserver and Akey HTTP Parameters Parsing CVE-2015-6946 Buffer Overflow CVE-2015-6946 server-webapp 2
SERVER-WEBAPP Reprise License Manager HTTP Parameters Parsing CVE-2015-6946 Buffer Overflow CVE-2015-6946 server-webapp 2
SERVER-WEBAPP SonicWall SonicOS SSLVPN getSslvpnSessionFromCookie CVE-2024-53704 Authentication Bypass CVE-2024-53704 server-webapp 1

Terms Explained

Name: Name of the Signature.

CVE-ID: CVE Identification Number - Common Vulnerabilities and Exposures (CVE) provides reference of CVE Identifiers for publicly known information security vulnerabilities.

Category: Class type according to threat.

Severity: Degree of severity - The levels of severity are described in the table below:

Fixed issues, listed by ID, description, explanation and Workaround.
Severity Level Severity Criteria
1 Critical
2 Major
3 Moderate
4 Minor
5 Warning
Important Notice

Sophos Technologies Pvt. Ltd. has supplied this Information believing it to be accurate and reliable at the time of printing, but is presented without warranty of any kind, expressed or implied. Users must take full responsibility for their application of any products. Sophos Technologies Pvt. Ltd. assumes no responsibility for any errors that may appear in this document. Sophos Technologies Pvt. Ltd. reserves the right, without notice to make changes in product design or specifications. Information is subject to change without notice.

RESTRICTED RIGHTS

©1997 - 2025 Sophos Ltd. All rights reserved.
All rights reserved. Sophos, Sophos logo are trademark of Sophos Technologies Pvt. Ltd.

Corporate Headquarters

Sophos Technologies Pvt. Ltd.
Registered in England and Wales No. 2096520,
The Pentagon, Abingdon Science Park,
Abingdon, OX14 3YP, UK
Web site:
www.sophos.com

© 1997-2025 Sophos Ltd. All Rights Reserved.
Legal
Privacy
Cookies