Are we affected by the sophos CAB vulnerability?

[NtroP_ironport]

SANS is reporting a critical vulnerability in Sophos Anti-Virus products that can allow remote code execution. ( http://isc.incidents.org/diary.php?storyid=1325 ) Is the version that IronPort uses vulnerable?

[tminchin_ironport]

According to Customer Support AsyncOS 4.6.0+ uses Sophos 4.0.5 which is not affected.