3 ms·
I am by no means even competent at network security; I am curious why articles like http://online.wsj.com/news/articles/SB10001424052702303873604579493963847851
by curiouscats 13y ago
I am by no means even competent at network security; I am curious why articles like http://online.wsj.com/news/articles/SB10001424052702303873604579493963847851346 http://online.wsj.com/news/articles/SB1000142405270230387360... seem to imply companies will have to physically replace network gear?
I would think software updates would allow the code to be updated.
Even if somehow they were worried the attacker has gained access and done things that might be a security problem can't you essentially reset the software and start from scratch if you couldn't trust you could find changes that were made, accounts added…? Maybe that shows how naive I am about network hardware?
- jlgaddis 13y agoI can't read the article but it's possibly because there is a LOT of EoL network gear still out there that won't be getting updated software.
- sspiff 13y agoThe bug has "only" been present for 3 years. I think no enterprise appliance new enough to ship with an affected OpenSSL version is old enough to be EoL.
- jlgaddis 13y agoYou're probably right, but what about pre-existing kit that received an update that included the b0rked version of SSL and went EoL since? I haven't kept up on what version of FreeBSD is being used as the basis of JunOS nowadays but I would not be surprised to hear of EoL Juniper kit that included the flawed code. (I have no evidence that JunOS includes OpenSSL code but I assume that it does.)
- peterwwillis 13y agoIt's not just EoL that has to be replaced. If you don't have a support contract and can't afford/don't want to renew, and the patch is under support only, you have to replace your gear because you can't get the patch.
- mkonecny 13y agoIt's been present for 2 years.