OK, so I first heard about heartbleed a few hours ago through the stack exchange questions feed, and after a moments panic, realised that the only web servers I have secured via OpenSSL are on the internal network. Patched anyway, but now I have been scratching my head on whether or not other services are vulnerable. Specifically I am wondering about Router type devices such as:
- Cisco ASA's
- DD-WRT routers
- NAS's with VPN support
I believe some of these use OpenSSL for things like SSH, point to point or site to site VPN's, the mini web servers they run for admin interface, etc. But I have been batting my head against a wall trying to find the versions running on them. For instance, on our DD-WRT device, I have been unable to even find an OpenSSL command in the filesystem, so maybe I am wrong on them using OpenSSL at all.
I am fairly sure that ASA's running 8.4 are on 0.9.8 and thus safe (but would really like confirmation as, again, I was unable to find this for certain in the ASDM or telnet interfaces), and if that's true I suppose we can assume older versions of ASA will be similarly safe.
Does anyone have any information on these kind of devices?
Edit: I've been reading these meta questions (they're on SO, but I think they may be stack-agnostic, as it were) to try to figure out what the best practise is here, as I think the correct answer may actually be a combination of what's here. That's probably my fault as much as any, because I suppose this is actually a compound question itself. I've considered posting my own answer and accepting it combining the available information about several devices, plus what I found about the exact affected DD-WRT build numbers, but I wonder if that's not kind of rude considering that you guys have supplied most of it and that way I deny EVERYONE the accepted answer rep. I know the accepted practise (from those meta.SO links) seems to be to pick a best one by my own conditions and upvote the rest (the latter of which is done), but different answers here are equally good for different parts of my question. Any thoughts? (Even, should this edit be a meta.sec question of it's own? I hesitate to do that when the question seems to be asked so many times already on other meta's)