topic Re: OpenSSL Heartbleed bug: CVE-2014-0160 in General Topics

OpenSSL Heartbleed bug: CVE-2014-0160

AdamBatey — Tue, 08 Apr 2014 05:35:20 GMT

Hi,

Just wondering if any Palo Alto versions are affected by this bug in OpenSSL?

Regards

Re: OpenSSL Heartbleed bug: CVE-2014-0160

MijndertS — Tue, 08 Apr 2014 07:39:32 GMT

I would like to know this, too. We need a word on this, anything really. A security company like Palo Alto should be on top of issues like this.

Re: OpenSSL Heartbleed bug: CVE-2014-0160

cramman — Tue, 08 Apr 2014 12:16:17 GMT

likewise - are the PAN devices using OpenSSL under the hood for cert creation?

If so, which vers?

I know many of our F5s are "safe" as they run 0.9.8x

Any plans on releasing an update to patch CVE-2014-0160 exploits?

Re: OpenSSL Heartbleed bug: CVE-2014-0160

gafrol — Tue, 08 Apr 2014 13:55:00 GMT

I have tested GP SSL VPN for the heartbleed bug. It seems PANOS 6.0.1 is not vulnerable.

Re: OpenSSL Heartbleed bug: CVE-2014-0160

gafrol — Tue, 08 Apr 2014 14:01:09 GMT

I just tested the same against 5.0.10 --> Not vulnerable !

Re: OpenSSL Heartbleed bug: CVE-2014-0160

dpalani — Tue, 08 Apr 2014 14:18:37 GMT

Palo Alto Networks does not use the Open SSL version that has this vulnerability. Please open a support case if you would like to get more info in the coverage for CVE-2014-0160.

Deepak

Re: OpenSSL Heartbleed bug: CVE-2014-0160

ericgearhart — Tue, 08 Apr 2014 14:38:09 GMT

We really need some kind of a badge or little PA icon indicator next to people that actually work for PA, that are speaking on behalf of the company. I have no idea if dpalani works for PA or not, and whether this is the "official word" or not

Re: OpenSSL Heartbleed bug: CVE-2014-0160

choff123 — Tue, 08 Apr 2014 17:18:17 GMT

agreed, im calling to confirm 100%. this ones a doozy.

Re: OpenSSL Heartbleed bug: CVE-2014-0160

dpalani — Tue, 08 Apr 2014 17:35:11 GMT

CVE-2014-0160 is reported on open ssl version 1.0.1 and the firewall uses version 0.9.8, you are more than welcome to open up a case with support and confirm that.

Regards.

Deepak

Re: OpenSSL Heartbleed bug: CVE-2014-0160

Dpeters1 — Tue, 08 Apr 2014 19:01:46 GMT

Anyone spoken with support about a Vulnerability Protection signature update to catch this?

Or has anyone managed to create a custom signature?

Re: OpenSSL Heartbleed bug: CVE-2014-0160

pwebber — Tue, 08 Apr 2014 19:50:48 GMT

I would like to know this as well. I was thinking about trying to do this but I think this is big enough Palo Alto should do this if it is possible. This would be great to buy us some time on mitigating this.

Re: OpenSSL Heartbleed bug: CVE-2014-0160

NoahMH — Tue, 08 Apr 2014 20:22:33 GMT

PAN-OS is not vulnerable to this bug, as we use an older branch of OpenSSL (0.9.8) which is not affected by this issue.

--Noah

Palo Alto Networks Support

Re: OpenSSL Heartbleed bug: CVE-2014-0160

NoahMH — Tue, 08 Apr 2014 20:23:29 GMT

Is PAN-OS vulnerable?

PAN-OS is not vulnerable, as we use an older branch of OpenSSL (0.9.8) which is not affected by this issue.

Are Palo Alto Networks public services vulnerable?

We are in the midst of evaluating our own exposure to CVE-2014-0160 within our public-facing infrastructure, including the update service, WildFire, PAN-DB, public web site, etc. We do not yet have the results of this analysis but we will provide an update once our investigation and remediation is complete.

Does Palo Alto Networks provide IPS coverage for this vulnerability?

Our threat research team is researching the vulnerability in an effort to provide coverage ASAP. We hope to have coverage released late today, but we cannot commit to a release timeframe until protections are developed and tested.

What should customers do if they identify vulnerable servers (running OpenSSL 1.0.1 through 1.0.1f)?

Vulnerable servers should be patched to OpenSSL 1.0.1g (available as of April 7th 2014). SSL private keys should be assumed to be compromised and should be replaced after the OpenSSL patch is in place.

Re: OpenSSL Heartbleed bug: CVE-2014-0160

tstores — Tue, 08 Apr 2014 21:07:30 GMT

I was wondering if we could create a vulnerability signature to alert, then setup a rule to block this type of traffic.

Re: OpenSSL Heartbleed bug: CVE-2014-0160

chrisp — Wed, 09 Apr 2014 05:08:51 GMT

Any update on the timing of the IPS signature release for this?

Re: OpenSSL Heartbleed bug: CVE-2014-0160

gafrol — Wed, 09 Apr 2014 13:14:42 GMT

Application and Threat Content Release Notes

Version 429

Notes: A critical vulnerability in OpenSSL (CVE-2014-0160: OpenSSL Private Key Disclosure Vulnerability) was recently disclosed, affecting servers running OpenSSL 1.0.1 through 1.0.1f. This vulnerability allows arbitrary memory readout, which effectively exposes primary key material and compromises the integrity of the secure channel.

To address this vulnerability, Palo Alto Networks has released an emergency content update that provides detection of attempted exploitation of CVE-2014-0160 with IPS vulnerability signature ID 36416 ("OpenSSL TLS Heartbeat Information Disclosure Vulnerability") with critical severity and a default action of block. Palo Alto Networks customers with a Threat Prevention subscription are advised to verify that they are running the latest content version on their devices. If you have any questions about coverage for this advisory, please contact Support.

Modified Decoders (1)

Name

ssl

New Vulnerability Signatures (1)

Severity	ID	Attack Name	CVE ID	Vendor ID	Default Action	Minimum PAN-OS Version
critical	36416	OpenSSL TLS Heartbeat Information Disclosure Vulnerability	CVE-2014-0160	reset-server	3.1.0

Re: OpenSSL Heartbleed bug: CVE-2014-0160

infotech — Wed, 09 Apr 2014 13:36:18 GMT

How do you check for ssl version

Re: OpenSSL Heartbleed bug: CVE-2014-0160

aglej — Wed, 09 Apr 2014 14:24:40 GMT

Anyone else not able to get this update to show up in dynamic updates? Or am I missing something?

Re: OpenSSL Heartbleed bug: CVE-2014-0160

gafrol — Wed, 09 Apr 2014 14:26:37 GMT

I have installed Application and Threat Content Release 429 but I cannot find the Signature....?

Anyone else ?

I just checked on the Dynamic Updates Website on Support, it's not there.... Withdrawal ?

Re: OpenSSL Heartbleed bug: CVE-2014-0160

dbaumann — Wed, 09 Apr 2014 14:34:05 GMT

Version 429 isn't showing up for me either.