- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
04-07-2014 10:35 PM
Hi,
Just wondering if any Palo Alto versions are affected by this bug in OpenSSL?
Regards
04-08-2014 12:39 AM
I would like to know this, too. We need a word on this, anything really. A security company like Palo Alto should be on top of issues like this.
04-08-2014 05:16 AM
likewise - are the PAN devices using OpenSSL under the hood for cert creation?
If so, which vers?
I know many of our F5s are "safe" as they run 0.9.8x
Any plans on releasing an update to patch CVE-2014-0160 exploits?
04-08-2014 06:55 AM
I have tested GP SSL VPN for the heartbleed bug. It seems PANOS 6.0.1 is not vulnerable.
04-08-2014 07:01 AM
I just tested the same against 5.0.10 --> Not vulnerable !
04-08-2014 07:18 AM
Palo Alto Networks does not use the Open SSL version that has this vulnerability. Please open a support case if you would like to get more info in the coverage for CVE-2014-0160.
Deepak
04-08-2014 07:38 AM
We really need some kind of a badge or little PA icon indicator next to people that actually work for PA, that are speaking on behalf of the company. I have no idea if dpalani works for PA or not, and whether this is the "official word" or not
04-08-2014 10:18 AM
agreed, im calling to confirm 100%. this ones a doozy.
04-08-2014 10:35 AM
CVE-2014-0160 is reported on open ssl version 1.0.1 and the firewall uses version 0.9.8, you are more than welcome to open up a case with support and confirm that.
Regards.
Deepak
04-08-2014 12:01 PM
Anyone spoken with support about a Vulnerability Protection signature update to catch this?
Or has anyone managed to create a custom signature?
04-08-2014 12:50 PM
I would like to know this as well. I was thinking about trying to do this but I think this is big enough Palo Alto should do this if it is possible. This would be great to buy us some time on mitigating this.
04-08-2014 01:23 PM
Is PAN-OS vulnerable?
PAN-OS is not vulnerable, as we use an older branch of OpenSSL (0.9.8) which is not affected by this issue.
Are Palo Alto Networks public services vulnerable?
We are in the midst of evaluating our own exposure to CVE-2014-0160 within our public-facing infrastructure, including the update service, WildFire, PAN-DB, public web site, etc. We do not yet have the results of this analysis but we will provide an update once our investigation and remediation is complete.
Does Palo Alto Networks provide IPS coverage for this vulnerability?
Our threat research team is researching the vulnerability in an effort to provide coverage ASAP. We hope to have coverage released late today, but we cannot commit to a release timeframe until protections are developed and tested.
What should customers do if they identify vulnerable servers (running OpenSSL 1.0.1 through 1.0.1f)?
Vulnerable servers should be patched to OpenSSL 1.0.1g (available as of April 7th 2014). SSL private keys should be assumed to be compromised and should be replaced after the OpenSSL patch is in place.
04-08-2014 02:07 PM
I was wondering if we could create a vulnerability signature to alert, then setup a rule to block this type of traffic.
04-08-2014 10:08 PM
Any update on the timing of the IPS signature release for this?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!