Release history
4.2-4-0
Directory traversal with tar archives
Using special options in tar archives, arbitrary files could be overwritten when extracting the archive. Still sufficient
file access permissions had been required though.
Failure notification of Kaspersky signature update
Failed signature updates due to connection errors have not been detected since Kaspersky 5.5.4.27-0 (update 4.2-3.0). No error
notification has been sent to the administrator.
Update of Linux kernel
This release will update the Linux kernel to 2.4.33. After the update the system will reboot automatically. Please do not
reboot by hand.
Update of the IPSec VPN
The new IPSec module will be required by future extensions.
Update of the virusscan proxy
The new release should fix the remaining problems.
F-Secure antivirus license key
Beginning with this release, the F-Secure antivirus scanner requires its own license key. Scanner licenses which have been
purchased before 2007-01-01 will be recognized by the update. For scanner licenses purchased after this date you will receive
a key file which has to bee installed in menu "Expert -> Virusscanner".
F-Secure Antivirus problems with various archive formats
Speedup of Kaspersky Antivirus signature update
Potential crash of SIP proxy
More mailclient parameters
Builtin proxylist databases
Builtin anti-spyware databases for firewall and DNS
Minor bugfixes and improvements
4.2-3-8
Buffer overflow in gzip archive tool
Expanding a specially crafted archive, gzip could crash or enter an infinite loop. The flaw could also be used to execute
arbitrary code.
Update of OpenSSL crypt library
A buffer overflow and denial-of-service vulnerabilities will be fixed with this update.
IPSec stopped after ADSL restart
In particular after installing an update on systems with persistent ADSL connection, the IPSec service failed to restart automatically.
Possible denial of service against SSH server
The secure shell server is vulnerable to a denial-of-service attack. Usually only remote support will use this feature, so
in most environments this is not a critical problem.
Option to increase SPAM filter score of kyrillic mails
Minor bugfixes and improvements
4.2-3-7
Update of OpenSSL crypt library
A vulnerability has been fixed which allowed to forge a certificate signature under very specific conditions. Although an
analysis of our system showed that it's most likely not vulnerable we decided to provide an update to be on the safe side.
Possible denial of service against DNS server
The server could be crashed by sending specific recursive queries. On a properly configured system only internal IP adresses
are allowed to send recursive queries.
Minor bugfixes and improvements
4.2-3-6
Possible denial of service against mail server
With a specially crafted email an attacker could crash the mail server.
Web access to MIME filter quarantine directory
With this new release it becomes easy to access attachments which have been quarantined by the MIME filter. Simply download
them in menu "Monitoring -> Mail server". Remember to be very careful with attachments sent by someone you do not trust or
with unusual file names.
Occasional crashes of virusscan proxy
Some customers still report crashes of the new virusscan proxy. The new version restarts it automatically in case of a crash.
Hopefully we can provide a clean solution soon.
Minor bugfixes and improvements
4.2-3-5
Virusscan proxy crash
Since the virusscan proxy was updated in 4.2-3.3 it sometimes crashed when both, virusscan and tagfilter have been enabled
for the same mime type.
Disabled rekeying for L2TP IPSec VPN
From now on only the client will initiate a rekeying. The server initiated rekeying is not supported by Windows builtin L2TP
IPSec anyway. As a side effect most of the connections in %hold state will disappear.
Assigned DNS for L2TP clients now configurable
Minor bugfixes and improvements
4.2-3-4
Virusscan proxy corrupting downloaded files
The updated virusscan proxy which came with update 4.2-3.3 may damage downloads with Internet Explorer on Windows XP SP2.
Optimized mail statistics generator
On some systems with high email traffic the mail statistics generator caused problems due to the large amounts of memory it
required. The new highly optimized version should solve this problem.
Enabled relay SPAM filter disables individual SPAM filter
To avoid overload it is no longer possible to run the SPAM filter on both stages: as relay and as user specific SPAM filter.
As long as the relay SPAM filter is enabled, the individual SPAM filter is unavailable.
Minor bugfixes and improvements
4.2-3-3
Display software with network monitor
The display software running on 19" systems with LCD panel will now include a network monitor. It shows the current throughput
of each network interface.
Configuration of whole subnets for L2TP address pool
It is now possible to add ranges of IPs to the L2TP address pool by specifying network addresses with corresponding netmask.
You need to type less and it saves system performance.
McAfee signature updates with active FTP
Signature updates may fail due to overloaded McAfee FTP servers, reporting too many passive mode connections. It is now possible
to use active mode FTP instead.
DNS anti spyware after system reset
On new or reset systems and after uploading a system backup the DNS server refused to start with DNS anti ad-/spyware option
enabled.
Service start after automatic update
Some services which had been stopped during an automatic update have not been started again, depending on their actual configuration.
New virusscan proxy for future extensions
Minor bugfixes and improvements
4.2-3-2
Delete web cache contents feature
At the request of many users finally available: A button to delete the contents of the web cache.
Extended URL filter access denied message
In addition to the simple "Access denied" message you can now configure a more detailed message which provides a hint why
access has been blocked. It is also possible to redirect the forbidden message to a custom web page.
Endless loop while generating email statistics
With users forwarding or aliasing email to oneself, the mail statistics could enter an endless loop.
Mails and downloads denied a few days before the Kaspersky license expires
The status code returned by the Kaspersky virus scanner indicating that the license key will expire within the next two weeks
was misinterpreted as a scan failure. Hence the delivery of mails and downloads was denied.
Relay SPAM filter not refusing emails
The problem occured since 4.2-3.0 if the relay SPAM filter had been configured to redirect tagged emails to a specific address.
Mails with a score exceeding the threshold to refuse delivery have been accepted and redirected, too.
Problems with Kaspersky update, backup and logfile archiver via proxy
CA signed certificates can now be issued for either one, two or three years
Minor bugfixes and improvements
4.2-3-1
Error creating mailbackups
Due to an error in update 4.2-3.0 the mailbackup will abort on systems with lots of available disk space. Update 4.2-3.0 has
been fixed on 2006-03-28, 9:00 a.m. CEST. If the new 4.2-3.0 update file has been installed, the system is not affected.