OpenSSL Heartbleed bug: CVE-2014-0160

Reply
L1 Bithead

OpenSSL Heartbleed bug: CVE-2014-0160

Hi,

Just wondering if any Palo Alto versions are affected by this bug in OpenSSL?

http://heartbleed.com/

Regards

Tags (3)
Not applicable

Re: OpenSSL Heartbleed bug: CVE-2014-0160

I would like to know this, too. We need a word on this, anything really. A security company like Palo Alto should be on top of issues like this.

L2 Linker

Re: OpenSSL Heartbleed bug: CVE-2014-0160

likewise - are the PAN devices using OpenSSL under the hood for cert creation?

If so, which vers?

I know many of our F5s are "safe" as they run 0.9.8x

Any plans on releasing an update to patch CVE-2014-0160 exploits?

L4 Transporter

Re: OpenSSL Heartbleed bug: CVE-2014-0160

I have tested GP SSL VPN for the heartbleed bug. It seems PANOS 6.0.1 is not vulnerable.

L4 Transporter

Re: OpenSSL Heartbleed bug: CVE-2014-0160

I just tested the same against 5.0.10 --> Not vulnerable !

L3 Networker

Re: OpenSSL Heartbleed bug: CVE-2014-0160

Palo Alto Networks does not use the Open SSL version that has this vulnerability. Please open a support case if you would like to get more info in the coverage for CVE-2014-0160.

Deepak

L4 Transporter

Re: OpenSSL Heartbleed bug: CVE-2014-0160

We really need some kind of a badge or little PA icon indicator next to people that actually work for PA, that are speaking on behalf of the company. I have no idea if dpalani works for PA or not, and whether this is the "official word" or not

L3 Networker

Re: OpenSSL Heartbleed bug: CVE-2014-0160

agreed, im calling to confirm 100%. this ones a doozy.

L3 Networker

Re: OpenSSL Heartbleed bug: CVE-2014-0160

CVE-2014-0160 is reported on open ssl version 1.0.1 and the firewall uses version 0.9.8, you are more than welcome to open up a case with support and confirm that.

Regards.

Deepak

L2 Linker

Re: OpenSSL Heartbleed bug: CVE-2014-0160

Anyone spoken with support about a Vulnerability Protection signature update to catch this?

Or has anyone managed to create a custom signature?

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!