4 ms·

OpenSSL Heartbeat Extension Vulnerability in Multiple Cisco Products

78 points by 001sky 13y ago

seldo 13y ago
Can somebody more familiar with Cisco products look at the list and break this down a bit? Are these mostly edge-of-network devices, or are these big switches that tons of traffic run through? Does being vulnerable to Heartbleed necessarily mean traffic through these boxes is vulnerable?
- dmix 13y ago
  That depends, can the routers be accessed remotely over WAN? If so an admin password might pop up in memory scans allowing a compromise. From there remote software can be downloaded to the router, potentially allowing snooping/mirroring of traffic. But it's likely most of the them (ie the important ones) are behind local firewalls and VPNs.
  - kyrra 13y ago
    Exactly. Most affected products will be management interfaces for these devices. From my experience, enterprise type products direct you to put management ports on protected networks. IT people don't always follow this, but it's at least the recommendation.
  - rdl 13y ago
    Except, uh, their VPN client software :) And a lot of their WebEx, VoIP and VTC, which will be accessible either entirely within the organization, or on public networks. Looks like most of their actual routers and stuff are not affected, which is unsurprising -- they SSH, not SSL, and it's unlikely they'd be running OpenSSL 1.0.1.
- jlgaddis 13y ago
  > Are these mostly edge-of-network devices, or are these big switches that tons of traffic run through? IOS routers and ASA firewalls are on the "not affected" list. Those are what you'd find in most SMBs. IOS-XR and NX-OS are affected, however. This software runs on the BFRs like you'd see in major ISPs and large networks. > Does being vulnerable to Heartbleed necessarily mean traffic through these boxes is vulnerable? I'm speculating but based on what I know about Cisco gear, I'm gonna have to say no. At most, you'd get the same stuff you'd get from a server: the private keys, login credentials, copies of the configuration, etc. -- anything that's handled by the control plane of the routers, basically. The frames/packets passing through them are handled by ASICs and are never copied to the memory used by the CPU, AIUI. Assuming best practices are followed, a random attacker would never be able to establish a connection (e.g. to 443/TCP) anyways, which would mitigate the risk. In a properly managed network, access to the router itself is highly restricted by ACLs and such.
curiouscats 13y ago
I am by no means even competent at network security; I am curious why articles like http://online.wsj.com/news/articles/SB10001424052702303873604579493963847851346 http://online.wsj.com/news/articles/SB1000142405270230387360... seem to imply companies will have to physically replace network gear? I would think software updates would allow the code to be updated. Even if somehow they were worried the attacker has gained access and done things that might be a security problem can't you essentially reset the software and start from scratch if you couldn't trust you could find changes that were made, accounts added…? Maybe that shows how naive I am about network hardware?
- jlgaddis 13y ago
  I can't read the article but it's possibly because there is a LOT of EoL network gear still out there that won't be getting updated software.
  - sspiff 13y ago
    The bug has "only" been present for 3 years. I think no enterprise appliance new enough to ship with an affected OpenSSL version is old enough to be EoL.
    - jlgaddis 13y ago
      You're probably right, but what about pre-existing kit that received an update that included the b0rked version of SSL and went EoL since? I haven't kept up on what version of FreeBSD is being used as the basis of JunOS nowadays but I would not be surprised to hear of EoL Juniper kit that included the flawed code. (I have no evidence that JunOS includes OpenSSL code but I assume that it does.)
    - peterwwillis 13y ago
      It's not just EoL that has to be replaced. If you don't have a support contract and can't afford/don't want to renew, and the patch is under support only, you have to replace your gear because you can't get the patch.
    - 13y ago
louwrentius 13y ago
Some HP Storage appliances (SAN) like the MSA P2000 G3 is also vulnerable. Everything is suspect. We are a HP shop and I wonder if the switches are affected too, but we are too stupid to have them configured with SSL. APC UPS, HVAC, etc. This all goes to show: make sure that you have a special management network separate from the rest of your infrastructure that is only accessible for sysadmins, through a trusted console server.

78 points by 001sky 13y ago

seldo 13y ago

Can somebody more familiar with Cisco products look at the list and break this down a bit? Are these mostly edge-of-network devices, or are these big switches that tons of traffic run through? Does being vulnerable to Heartbleed necessarily mean traffic through these boxes is vulnerable?

dmix 13y ago
That depends, can the routers be accessed remotely over WAN? If so an admin password might pop up in memory scans allowing a compromise. From there remote software can be downloaded to the router, potentially allowing snooping/mirroring of traffic. But it's likely most of the them (ie the important ones) are behind local firewalls and VPNs.
- kyrra 13y ago
  Exactly. Most affected products will be management interfaces for these devices. From my experience, enterprise type products direct you to put management ports on protected networks. IT people don't always follow this, but it's at least the recommendation.
- rdl 13y ago
  Except, uh, their VPN client software :) And a lot of their WebEx, VoIP and VTC, which will be accessible either entirely within the organization, or on public networks. Looks like most of their actual routers and stuff are not affected, which is unsurprising -- they SSH, not SSL, and it's unlikely they'd be running OpenSSL 1.0.1.
jlgaddis 13y ago
> Are these mostly edge-of-network devices, or are these big switches that tons of traffic run through? IOS routers and ASA firewalls are on the "not affected" list. Those are what you'd find in most SMBs. IOS-XR and NX-OS are affected, however. This software runs on the BFRs like you'd see in major ISPs and large networks. > Does being vulnerable to Heartbleed necessarily mean traffic through these boxes is vulnerable? I'm speculating but based on what I know about Cisco gear, I'm gonna have to say no. At most, you'd get the same stuff you'd get from a server: the private keys, login credentials, copies of the configuration, etc. -- anything that's handled by the control plane of the routers, basically. The frames/packets passing through them are handled by ASICs and are never copied to the memory used by the CPU, AIUI. Assuming best practices are followed, a random attacker would never be able to establish a connection (e.g. to 443/TCP) anyways, which would mitigate the risk. In a properly managed network, access to the router itself is highly restricted by ACLs and such.

curiouscats 13y ago

I am by no means even competent at network security; I am curious why articles like http://online.wsj.com/news/articles/SB10001424052702303873604579493963847851346 http://online.wsj.com/news/articles/SB1000142405270230387360... seem to imply companies will have to physically replace network gear? I would think software updates would allow the code to be updated. Even if somehow they were worried the attacker has gained access and done things that might be a security problem can't you essentially reset the software and start from scratch if you couldn't trust you could find changes that were made, accounts added…? Maybe that shows how naive I am about network hardware?

jlgaddis 13y ago
I can't read the article but it's possibly because there is a LOT of EoL network gear still out there that won't be getting updated software.
- sspiff 13y ago
  The bug has "only" been present for 3 years. I think no enterprise appliance new enough to ship with an affected OpenSSL version is old enough to be EoL.
  - jlgaddis 13y ago
    You're probably right, but what about pre-existing kit that received an update that included the b0rked version of SSL and went EoL since? I haven't kept up on what version of FreeBSD is being used as the basis of JunOS nowadays but I would not be surprised to hear of EoL Juniper kit that included the flawed code. (I have no evidence that JunOS includes OpenSSL code but I assume that it does.)
  - peterwwillis 13y ago
    It's not just EoL that has to be replaced. If you don't have a support contract and can't afford/don't want to renew, and the patch is under support only, you have to replace your gear because you can't get the patch.
  - 13y ago

louwrentius 13y ago

Some HP Storage appliances (SAN) like the MSA P2000 G3 is also vulnerable. Everything is suspect. We are a HP shop and I wonder if the switches are affected too, but we are too stupid to have them configured with SSL. APC UPS, HVAC, etc. This all goes to show: make sure that you have a special management network separate from the rest of your infrastructure that is only accessible for sysadmins, through a trusted console server.