Most small offices have a firewall sitting in a closet or on a shelf next to the internet modem. It was set up years ago, it still blinks, and nobody has thought about it since. This week is a good time to change that.
On November 3, SonicWall published a security notice (updated November 6) about several security flaws in the software that runs its current firewalls. SonicWall rates the most serious of them high severity, 8.8 on a 10-point scale. Fixed software is now available for both, and SonicWall is asking customers to install it.
What a firewall does, in plain terms
A firewall is the front door lock for your office network. It sits between your computers and the internet, lets in the traffic you want, and keeps out the traffic you don't. Many firewalls also handle the VPN connections people use to work from home. Because it faces the internet all day, a flaw in its software is worth fixing quickly.
What SonicWall announced
SonicWall found several high- and medium-severity flaws in SonicOS, the software that runs its firewalls. The fixes are in two new versions:
- Gen 7 firewalls (TZ, NSa, NSsp and NSv models): update to SonicOS 7.3.4-7013 or later. That version has been available since October 20, and 7.3.4-7015 followed on November 5.
- Gen 8 firewalls: update to SonicOS 8.2.3-8015, which is now available.
SonicWall says it will publish the full technical advisory, with CVE numbers, separately. As of this morning (November 9) it hasn't appeared yet, and SonicWall's notice doesn't say the flaws are being used in attacks. Even so, there's no reason to wait. Fixes like this are easiest to apply before anyone starts taking advantage of the flaws.
The bigger problem: older firewalls won't get a fix
These updates are only for Gen 7 and Gen 8 models. Gen 6 and older SonicWall firewalls have reached end of support, which means SonicWall no longer releases updates for them, for this issue or any future one.
A firewall that no longer gets updates often keeps working just fine, which is exactly why it gets overlooked. But every month, new flaws are found that will never be fixed on that device, and the risk keeps growing. If your firewall is a Gen 6 or older, the real fix is to replace it. SonicWall runs a trade-in program that discounts the move to a current model.
What to ask your IT provider
You don't need to log in to the firewall yourself. Just ask whoever manages your network:
- Which firewall model do we have, and which generation is it?
- What software version is it running, and when was it last updated?
- Has this month's SonicWall update been applied?
A quick checklist
- Model: Know the make and model of your firewall.
- Software version: Know what version it runs and when it was last updated.
- Support status: Confirm the manufacturer still releases updates for it.
- Alerts: Make sure someone gets notified when updates come out, and that it's their job to install them.
If you can tick all four boxes, you're in good shape. If you can't, it's worth finding out.
How we can help
SonicWall is one of our partners, and we install and look after SonicWall firewalls for many of our clients. If you're not sure what firewall your office uses or whether it's current, ProIT can check it in a short, no-pressure review and tell you where you stand. If it needs an update, we'll schedule it, and if it's past end of support, we'll help you choose a replacement. Contact us or call (480) 382-3289.
Source: SonicOS 7.3.4 and 8.2.3 Security Advisory: Gen 7 and Gen 8 Firewalls (SonicWall)