OpenSSL Heartbeat Extension Vulnerability in Multiple Cisco Products
tools.cisco.com
tools.cisco.com
Everything is suspect. We are a HP shop and I wonder if the switches are affected too, but we are too stupid to have them configured with SSL.
APC UPS, HVAC, etc.
This all goes to show: make sure that you have a special management network separate from the rest of your infrastructure that is only accessible for sysadmins, through a trusted console server.
I would think software updates would allow the code to be updated.
Even if somehow they were worried the attacker has gained access and done things that might be a security problem can't you essentially reset the software and start from scratch if you couldn't trust you could find changes that were made, accounts added…? Maybe that shows how naive I am about network hardware?
I haven't kept up on what version of FreeBSD is being used as the basis of JunOS nowadays but I would not be surprised to hear of EoL Juniper kit that included the flawed code. (I have no evidence that JunOS includes OpenSSL code but I assume that it does.)
Does being vulnerable to Heartbleed necessarily mean traffic through these boxes is vulnerable?
If so an admin password might pop up in memory scans allowing a compromise. From there remote software can be downloaded to the router, potentially allowing snooping/mirroring of traffic.
But it's likely most of the them (ie the important ones) are behind local firewalls and VPNs.
And a lot of their WebEx, VoIP and VTC, which will be accessible either entirely within the organization, or on public networks.
Looks like most of their actual routers and stuff are not affected, which is unsurprising -- they SSH, not SSL, and it's unlikely they'd be running OpenSSL 1.0.1.
IOS routers and ASA firewalls are on the "not affected" list. Those are what you'd find in most SMBs.
IOS-XR and NX-OS are affected, however. This software runs on the BFRs like you'd see in major ISPs and large networks.
> Does being vulnerable to Heartbleed necessarily mean traffic through these boxes is vulnerable?
I'm speculating but based on what I know about Cisco gear, I'm gonna have to say no. At most, you'd get the same stuff you'd get from a server: the private keys, login credentials, copies of the configuration, etc. -- anything that's handled by the control plane of the routers, basically. The frames/packets passing through them are handled by ASICs and are never copied to the memory used by the CPU, AIUI.
Assuming best practices are followed, a random attacker would never be able to establish a connection (e.g. to 443/TCP) anyways, which would mitigate the risk. In a properly managed network, access to the router itself is highly restricted by ACLs and such.