OpenSSL Heartbleed bug: CVE-2014-0160

[AdamBatey]

Hi,

Just wondering if any Palo Alto versions are affected by this bug in OpenSSL?

http://heartbleed.com/

Regards

[MijndertS]

I would like to know this, too. We need a word on this, anything really. A security company like Palo Alto should be on top of issues like this.

[cramman]

likewise - are the PAN devices using OpenSSL under the hood for cert creation?

If so, which vers?

I know many of our F5s are "safe" as they run 0.9.8x

Any plans on releasing an update to patch CVE-2014-0160 exploits?

[gafrol]

I have tested GP SSL VPN for the heartbleed bug. It seems PANOS 6.0.1 is not vulnerable.

[gafrol]

I just tested the same against 5.0.10 --> Not vulnerable !

[dpalani]

Palo Alto Networks does not use the Open SSL version that has this vulnerability. Please open a support case if you would like to get more info in the coverage for CVE-2014-0160.

Deepak

[ericgearhart]

We really need some kind of a badge or little PA icon indicator next to people that actually work for PA, that are speaking on behalf of the company. I have no idea if dpalani works for PA or not, and whether this is the "official word" or not

[choff123]

agreed, im calling to confirm 100%. this ones a doozy.

[dpalani]

CVE-2014-0160 is reported on open ssl version 1.0.1 and the firewall uses version 0.9.8, you are more than welcome to open up a case with support and confirm that.

Regards.

Deepak

[Dpeters1]

Anyone spoken with support about a Vulnerability Protection signature update to catch this?

Or has anyone managed to create a custom signature?