Tag Info

New answers tagged

0

There have since been updates from the Apache Struts Team: http://struts.apache.org/announce.html#a20140424


1

Synology is affected but is prepping an update for DSM 5 and DSM 4.3 tomorrow. A patch for DSM 4.2 will be delivered in one week. From a release I got from Synology (I'm a journalist): Synology® DSM 5.0 Secured Against OpenSSL Heartbleed Vulnerability Taipei, Taiwan—April 11st, 2014—Synology® Inc. today releases the latest DSM 5.0-4458 Update 2 to ...


2

On my DD-WRT router, access via ssh First I could see that the version on the /usr/lib/libssl* is 0.9.8 Also running strings on said lib shows v 0.9.8 within $ strings /usr/lib/libssl.so.0.9.8 | grep OpenS OpenSSLDie SSLv2 part of OpenSSL 0.9.8l 5 Nov 2009 SSLv3 part of OpenSSL 0.9.8l 5 Nov 2009 TLSv1 part of OpenSSL 0.9.8l 5 Nov 2009 DTLSv1 part of ...


1

as far as DD-WRT goes, it depends on the version. A lot of the "current" DD-WRT releases pre-date the introduction of the heartbeat feature (2012) and associated security vulnerability into openssl. If your DD-WRT was built since 2012 it is vulnerable. The version of DD-WRT I am running on my internal routers is from 11/12 and when I run the heartbleed test ...


3

From Cisco Security Advisory on OpenSSL Heartbeat Extension Vulnerability in Multiple Cisco Products (Advisory ID: cisco-sa-20140409-heartbleed, April 9, 2014): Vulnerable Product The following Cisco products are affected by this vulnerability: Cisco AnyConnect Secure Mobility Client for iOS Cisco Desktop Collaboration Experience DX650 ...


5

DD-WRT does use OpenSSL 1.0.1 and is vulnerable. There was an update posted just 22 hours ago to the trac page: http://svn.dd-wrt.com/browser/src/router/openssl You can view the CHANGES file for details.


2

In the OpenSSL code there are several string definitions related to the heartbeat feature: ./ssl/ssl_err.c:{ERR_FUNC(SSL_F_DTLS1_HEARTBEAT), "DTLS1_HEARTBEAT"}, ./ssl/ssl_err.c:{ERR_FUNC(SSL_F_TLS1_HEARTBEAT), "SSL_F_TLS1_HEARTBEAT"}, ./ssl/ssl_err.c:{ERR_REASON(SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT),"peer does not accept heartbearts"}, ...


10

I've found a nice post from a Cisco Support Engineer regarding to the ASA: However, if you are trying to find the OpenSSL version for an ASA (Adaptive Security Appliance), you can determine this version from the ASA release notes. Simply examine the "Open Source" notes that are located in the release notes of the particular ASA image you are concerned ...



Top 50 recent answers are included