topic RE: Meltdown and Spectre (VN 2018-001 & VN 2018-002) in Data Center (SLX)

Meltdown and Spectre (VN 2018-001 & VN 2018-002)

Drew_C — Sat, 06 Jan 2018 00:15:00 GMT

Hello everyone!
Extreme has published Vulnerability Notices to provide information on two issues known as Meltdown and Spectre.

VN 2018-001 (CVE-2017-5715, CVE-2017-5753 - Spectre)
VN 2018-002 (CVE-2017-5754 - Meltdown)

At this time, susceptibility to each of these issues is actively being investigated and there isn't much content in either VN. We will continue to update them (and this topic) as more information becomes available.

You can read more about these two attacks on the CERT website: https://www.kb.cert.org/vuls/id/584653

RE: Meltdown and Spectre (VN 2018-001 & VN 2018-002)

Bin — Sat, 06 Jan 2018 01:47:00 GMT

Hello Drew,
Thank you for updating those two notices.

RE: Meltdown and Spectre (VN 2018-001 & VN 2018-002)

Wesley_Jones — Thu, 11 Jan 2018 00:27:00 GMT

What is the timeline for updating these vulnerabilities on appliances like Extreme Management Center and NAC?

RE: Meltdown and Spectre (VN 2018-001 & VN 2018-002)

Drew_C — Thu, 11 Jan 2018 00:27:00 GMT

The information on this from various groups is being compiled now. Risk for all of these systems appears to be very low. We'll have better updates soon.

RE: Meltdown and Spectre (VN 2018-001 & VN 2018-002)

Drew_C — Fri, 12 Jan 2018 03:40:00 GMT

I've updated both of these VNs with preliminary information. Links above in the original post.

RE: Meltdown and Spectre (VN 2018-001 & VN 2018-002)

Bin — Fri, 12 Jan 2018 03:40:00 GMT

Hi Drew,
Thank you so much for your update.

Do we have any reason why we leave cell empty on "Meltdown Vulnerability Present" of ExtremeWireless and ExtremeWireless WiNG only?

Best regards

RE: Meltdown and Spectre (VN 2018-001 & VN 2018-002)

Drew_C — Fri, 12 Jan 2018 03:40:00 GMT

The information that I was provided didn't have that section filled in and I wanted to get it published. We'll update it as everything continues to come together. There's a lot of people looking at this issue, both internally and externally.

RE: Meltdown and Spectre (VN 2018-001 & VN 2018-002)

Bin — Fri, 12 Jan 2018 03:40:00 GMT

Hi Drew,
Thank you so much for your reply.

Best regards

RE: Meltdown and Spectre (VN 2018-001 & VN 2018-002)

Steven_Lin — Fri, 12 Jan 2018 12:58:00 GMT

Thanks for your update Drew! My customer was happy because no impact to his Extreme product

RE: Meltdown and Spectre (VN 2018-001 & VN 2018-002)

M_Nees — Fri, 12 Jan 2018 14:54:00 GMT

Whats about the legacy Enterasys gear:

S- / K -Series ? SecureStack Switches

It would be nice to find them in above tables (and see that there is no issue).

RE: Meltdown and Spectre (VN 2018-001 & VN 2018-002)

Drew_C — Fri, 12 Jan 2018 14:54:00 GMT

I'm working on getting that for everyone.

RE: Meltdown and Spectre (VN 2018-001 & VN 2018-002)

netengineering- — Fri, 12 Jan 2018 14:54:00 GMT

Are there any updates for the legacy Enterasys N series switch chassis?
Or do they fall under the non-vulnerable list as the other series?

RE: Meltdown and Spectre (VN 2018-001 & VN 2018-002)

StephanH — Thu, 28 Jun 2018 00:57:00 GMT

Hello,

are there any news regarding the VNs for XMC?

Best regards
Stephan