March 2020
On Thursday, April 11, researchers from the Carnegie Mellon University Software Engineering Institute published a global vulnerability regarding virtual private network (VPN) applications storing authentication and/or session cookies insecurely in memory and/or log files.At this time, SonicWall is not aware of any situation where a currently valid session token is written to log files outside of very specific debug configurations, which are being eliminated as a precaution to prevent any potential misuse. As such, SonicWall customers using IPSE
Researchers have found multiple defects including a Man-in-the-Middle (MITM) vulnerability in versions 1.0.1 and 1.0.2-beta of OpenSSL, the cryptographic software library. For detailed information on the Man-in-the-Middle and other vulnerabilities see the OpenSSL website. SonicWall Firewalls and GMS Are Not Affected SonicWall firewalls (TZ, NSA, E-Class NSA, SuperMassive) and Global Management System (GMS) are NOT affected by the vulnerabilities. Additionally, firewalls with an active Intrusion Prevention Service have, as of June 5, 2014, signa
Active Retirement Mode Announcement SonicWall is initiating the Active Retirement Mode (ARM) notification for the SonicWall NSA E6500. Active Retirement Mode is the second phase of the SonicWall End of Life process outlined at the end of this document. During this phase SonicWall will no longer actively manufacture or sell the products listed below. In addition, SonicWall may release a limited number of new features and will issue bug fixes only to the latest version of firmware available for the device After the ARM phase ha
SonicWall will discontinue support for Infobright MYSQL reporting database in GMS/Analyzer on November 30, 2018 All GMS/Analyzer customers using Infobright MYSQL reporting database must migrate from Infobright MYSQL reporting database to PostGres reporting database on or before November 30, 2018 to continue availing support services on GMS/Analyzer reporting.SonicWall will continue supporting PostGres reporting database in GMS/Analyzer. Please refer the to the following knowledge base article for more details: GMS Upgrade Matrix and Considerati
SonicWall previously announced that the SonicWall Enforced Client offerings (both McAfee and Kaspersky) are End of Life (EOL) and no longer available for purchase starting April 2018. McAfee also previously announced an EOL for the endpoint technology that was used; with Kaspersky it was a strategic decision to no longer sell the product due to government concerns raised by the product around data privacy. SonicWall now announces the End of Support dates for SonicWall Enforced Client as follows: January 11th 2019 – Limited Support for SonicWal
05/17/2019 05:00PM UTC - 05/19/2019 05:00PM UTC Please be aware that CSC-Management, Reporting and Analytics services for the Europe region will be upgraded to v1.5 from May 17th, 10 am to May 19th, 10am (PST). During this time, the services will experience downtime. Your firewall will remain active and you can log-in to the firewall web GUI to access it. Please contact SonicWall support for any assistance. We apologize for the inconvenience and thank you for your patience. Note: During downtime, you can continue to ma
What we know about the Critical Remote Code Execution Vulnerability (CVE-2019-1579) Researchers have found several security flaws in popular corporate VPNs, which they say can be used to silently break into company networks and steal business secrets. According to https://techcrunch.com/2019/07/23/corporate-vpn-flaws-risk/ “Devcore researchers Orange Tsai and Meh Chang said the flaws found in the three corporate VPN providers — Palo Alto Networks, Pulse Secure and Fortinet — are ‘easy’ to remotely exploit.” Once the SSL VPN server is compromis
SonicWall physical firewall appliances running certain versions of SonicOS contain vulnerabilities in code utilized for remote management. At this time, there is no indication that the discovered vulnerabilities are being exploited in the wild, however: SonicWall STRONGLY advises to apply the SonicOS patch immediately. IF you cannot update immediately, as a mitigation please restrict SonicWall management access (HTTPS/HTTP/SSH) to trusted sources and/or disable management access from untrusted Internet sources, then apply the SonicOS patch as s
Update as of 7/4/19 2:30 pm EST: The signature (SID 6855) has been removed from the Ultrasurf application. If you continue to experience issues with blocked apps/websites please update the App Control database by logging into the firewall and navigating to MANAGE | Rules | App Control and click Update. Status: Investigating July 4, 2019, 2 a.m. EST Issue: Skype, MS Teams, Slack and other applications may be blocked by App Control Signature ID 6855 - PROXY-ACCESS Ultrasurf. Cause: A new signature was released to block Ultrasurf but this
06/01/2019 04:00AM UTC - 06/03/2019 11:00AM UTC This is to notify that CSC-Management, Reporting and Analytics services for the North America region will be upgraded to v1.5 from May 31st, 9 pm to June 3rd, 4 am (PST). During this time, the services will experience downtime. Your firewall will remain active and you can log-in to the firewall web GUI to access it. We apologize for the inconvenience and thank you for your patience. Note: During downtime, you can continue to manage firewalls by logging to them directly. Please ensure that you have
December 2019
Dell SonicWALL - Active Retirement Mode Announcement for Dell SonicWALL TZ 105 Wired ModelActive Retirement Mode AnnouncementDell SonicWALL is initiating the Active Retirement Mode (ARM) notification for the Dell SonicWALL TZ 105 Wired model only. Active Retirement Mode is the second phase of the Dell SonicWALL End of Life process outlined at the end of this document. During this phase Dell SonicWALL will no longer actively manufacture or sell the products listed below. In addition, Dell SonicWALL may release a limited number
SonicWall - Last Day Order Announcement for SonicWall NSA 250M Wireless Model Last day Order Announcement SonicWall is initiating the Last Day Order (LDO) notification for the SonicWall NSA 250M Wireless. Last Day Order is the first phase of the SonicWall End of Life process outlined at the end of this document. During this phase, authorized SonicWall partners and distributors may purchase NSA 250M Wireless hardware SKUs from SonicWall. After the LDO phase has ended, SonicWall will no longer accept orders for the SKU
Last Day Order AnnouncementDell SonicWALL is initiating the Last Day Order (LDO) notification for the Dell SonicWALL SonicPoint-Ne Dual-Band. Last Day Order is the first phase of the Dell SonicWALL End of Life process outlined at the end of this document. During this phase, authorized Dell SonicWALL partners and distributors may purchase SonicPoint-Ne Dual-Band SKUs from Dell SonicWALL. After the LDO phase has ended, Dell SonicWALL will no longer accept orders for the SKUs listed below and the SonicPoint-Ne Dual-Band will tran
Active Retirement Mode AnnouncementDell SonicWALL is initiating the Active Retirement Mode (ARM) notification for the Dell SonicWALL TZ 215 Wired model. Active Retirement Mode is the second phase of the Dell SonicWALL End of Life process outlined at the end of this document. During this phase Dell SonicWALL will no longer actively manufacture or sell the products listed below. In addition, Dell SonicWALL may release a limited number of new features and will issue bug fixes only to the latest version of firmware available for
Limited Retirement Mode AnnouncementDell SonicWALL is initiating the Limited Retirement Mode (LRM) notification for the Dell SonicWALL ES 300. Limited Retirement Mode is the fourth phase of the Dell SonicWALL End of Life process outlined at the end of this document. During this phase Dell SonicWALL will no longer develop or release firmware updates or new features for these products. In addition, Dell SonicWALL will no longer offer support contracts. After the LRM phase has ended, Dell SonicWALL will transition the ES 30
SonicWall Last Day Order Announcement for SonicWall Universal Management Appliance UMA EM5000 Last Day Order Announcement SonicWall is initiating the Last Day Order (LDO) notification for the SonicWall Universal Management Appliance UMA EM5000. Last Day Order is the first phase of the SonicWall End of Life process outlined at the end of this document. During this phase, authorized SonicWall partners and distributors may purchase UMA EM5000 hardware SKUs from SonicWall. After the LDO phase has ended, SonicWall will no longer
Dell SonicWALL Active Retirement Mode Announcement for Dell SonicWALL NSA 8500Dell SonicWALL is initiating the Active Retirement Mode (ARM) notification for the Dell SonicWALL NSA E8500. Active Retirement Mode is the second phase of the Dell SonicWALL End of Life process outlined at the end of this document. During this phase Dell SonicWALL will no longer actively manufacture or sell the products listed below. In addition, Dell SonicWALL may release a limited number of new features and will issue bug fixes only to the latest v
End of Support AnnouncementDell SonicWALL is initiating the End of Support for GMS 7.0 and 7.1 All official End of Life notifications and phase information are posted on the Product Lifecycle page of our Support web site.Products Affected
Dell SonicWALL Notice Concerning Potential Back Doors into Dell SonicWALL FirewallsDear Customer, Over the past few weeks there has been a good deal of press coverage surrounding Juniper Networks related to an internal audit during which unauthorized code was discovered in ScreenOS that could be exploited by a knowledgeable attacker. Juniper has since addressed the issue and has made patches available for the vulnerable versions of its ScreenOS. This has to lead to speculation that products f
SonicWALL Service Bulletin GMS Analyzer Vulnerability Fix - July 2016Vulnerabilities in the Dell SonicWALL GMS and Analyzer have been resolved.Affected ProductsDell SonicWALL GMS and AnalyzerAffected Software VersionsVersions 8.0 and 8.1.Issue SummaryVulnerabilities were found pertaining to command injection, unauthorized XXE, default account, and unauthorized modification of virtual appliance networking information. To fix these vulnerabilities, Dell highly recommends that existing users of Dell SonicWALL GMS and Analyzer Hotfix 174525.GM