topic RE: Heartbleed OpenSSL Vulnerability in NMS/Oneview or Wireless Controller in ExtremeSwitching (EXOS/Switch Engine)

Heartbleed OpenSSL Vulnerability in NMS/Oneview or Wireless Controller

Skowronek__Kurt — Thu, 10 Apr 2014 03:34:00 GMT

Are NMS/Oneview, or the wireless controller at risk of the Heartbleed OpenSSL vulnerability? What revision levels are at risk? Is there a corporate statement of exposure risk and mitigation?
See similar post about XOS.
https://community.extremenetworks.com/extreme/topics/heartbleed_openssl_vulnerability

RE: Heartbleed OpenSSL Vulnerability in NMS/Oneview or Wireless Controller

Jeff_Creek — Thu, 10 Apr 2014 17:01:00 GMT

Netsite 5.0.0.231
SIEM 7.7.2 Patch 1 (Build 614901 (7.2.0.614901))
use libssl.so.1.0.0.

NAC Gateway 5.0.0.231
uses libssl.so 0.9.8

So it looks like those versions are not vulnerable.

RE: Heartbleed OpenSSL Vulnerability in NMS/Oneview or Wireless Controller

Paul_Russo — Thu, 10 Apr 2014 18:17:00 GMT

Hello Kurt

We will be publishing a formal document on what products are vulnerable and when they will be fixed in the next day or so.

Thanks
P

RE: Heartbleed OpenSSL Vulnerability in NMS/Oneview or Wireless Controller

Arun_Solleti — Thu, 10 Apr 2014 20:54:00 GMT

Hi

The version of OpenSSL used on the controller and legacy AP models i.e. 26xx & 36xx does not contain (or need) the functionality that is vulnerable to heartbleed.

The version of OpenSSL on the 37xx and 38xx series APs is custom built without the functionality that is vulnerable to heartbleed.

So no risk for IdentiFi products due to this vulnerability.

Thanks
Arun

RE: Heartbleed OpenSSL Vulnerability in NMS/Oneview or Wireless Controller

Paul_Poyant — Mon, 14 Apr 2014 23:45:00 GMT

See also, in the FAQ section of this forum:
16131, "Extreme Networks Response to US-CERT Vulnerability Advisory VU#720951" (http://bit.ly/1n6cUcI).