bugtraq - Cisco Security Advisory: OpenSSL Heartbeat Extension Vulnerability in Multiple Cisco Products

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-id: <201404082311.6.heartbleed@psirt.cisco.com>
Date: Tue,  8 Apr 2014 23:11:18 -0400
From: Cisco Systems Product Security Incident Response Team <psirt@...co.com>
To: bugtraq@...urityfocus.com
Cc: psirt@...co.com
Subject: Cisco Security Advisory: OpenSSL Heartbeat Extension Vulnerability in Multiple Cisco Products 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

OpenSSL Heartbeat Extension Vulnerability in Multiple Cisco Products

Advisory ID: cisco-sa-20140409-heartbleed

Revision 1.0

For Public Release 2014 April 9 03:00  UTC (GMT)

Summary
=======

Multiple Cisco products incorporate a version of the OpenSSL package affected by a vulnerability that could allow an unauthenticated, remote attacker to retrieve memory in chunks of 64 kilobytes from a connected client or server.

The vulnerability is due to a missing bounds check in the handling of the Transport Layer Security (TLS) heartbeat extension. An attacker could exploit this vulnerability by implementing a malicious TLS or Datagram Transport Layer Security (DTLS) client, if trying to exploit the vulnerability on an affected server, or a malicious TLS or DTLS server, if trying to exploit the vulnerability on an affected client. An exploit could send a specially crafted TLS or DTLS heartbeat packet to the connected client or server. An exploit could allow the attacker to disclose a limited portion of memory from a connected client or server for every heartbeat packet sent. The disclosed portions of memory could contain sensitive information that may include private keys and passwords.

Cisco is currently investigating its product line to determine which products may be affected by this vulnerability and the impact on the affected product. This advisory will be updated as additional information becomes available. 

Cisco will release free software updates that address these vulnerabilities.
Workarounds that mitigate these vulnerabilities may be available. 
This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-heartbleed
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools - http://gpgtools.org

iQIcBAEBAgAGBQJTRLhxAAoJEIpI1I6i1Mx3JOQP/09jLm0nSAp/xxKdPH6ch9LN
GfakZ2HyqHjEviTcwao63Ovj1sabvRcWss5g3C+sqEL42gYFBHU3t8SznB+HJLQI
kyTa3N94Jy/3k6eGdkF60RXI/5Tjox1pdeXacb9Evo9fROJOeX+TXuEVqrxKTydO
0MxEidSYZSsBnPtDBNc+ofoQfFhKQ9ZFnSmLhrgMQmFjCMfQ3GHVK/qECcsLFUMj
5tLdw22z7gALExUUwJvlKFsY5CGiRCrj5XUcgYMKIj54SYlzHRJuxVbqt+66QHwX
ohh7GJz7qHCn3/AU5PK5BGOe0/rzyibwKfbaNCMot4lZpmDMK/29UpQdYuDq50yp
OtEUh32+2BdxvNHKsU+Cq/k1rfZLGYMy4dSR6jvMj36BOl7Q2+DX4KacqQnjeMOS
6cKWnIMCVjtYYqi6lTaokV3VyiCADEvlkqyl1e6IGi+DBBrGNfaUkrMclRydbFKg
c2EYanb7pazXtO2MYp80IwrtQsvSFfNxTLqSgXJSIthHz00SgQGFEmDtAySShM7Q
P2kKGgXl8AYNPTj1nsBpzfrSUhbdHNp8g5VIZBDSatcYROrmsytYcHn8jexLkud+
eOcUHx65Sy+tVGd/bKwOroMfdevRjWLyaqUHH9i77lfknJGjwwKYtn6cN53/G9+/
EJ9K7MfbvMacbqu8n+3g
=PkOQ
-----END PGP SIGNATURE-----