Heartbleed and Routers/ASAs/other

Question

OK, so I first heard about heartbleed a few hours ago through the stack exchange questions feed, and after a moments panic, realised that the only web servers I have secured via OpenSSL are on the internal network. Patched anyway, but now I have been scratching my head on whether or not other services are vulnerable. Specifically I am wondering about Router type devices such as:

• Cisco ASA's
• DD-WRT routers
• NAS's with VPN support

I believe some of these use OpenSSL for things like SSH, point to point or site to site VPN's, the mini web servers they run for admin interface, etc. But I have been batting my head against a wall trying to find the versions running on them. For instance, on our DD-WRT device, I have been unable to even find an OpenSSL command in the filesystem, so maybe I am wrong on them using OpenSSL at all.

I am fairly sure that ASA's running 8.4 are on 0.9.8 and thus safe (but would really like confirmation as, again, I was unable to find this for certain in the ASDM or telnet interfaces), and if that's true I suppose we can assume older versions of ASA will be similarly safe.

Does anyone have any information on these kind of devices?

Edit: I've been reading these meta questions (they're on SO, but I think they may be stack-agnostic, as it were) to try to figure out what the best practise is here, as I think the correct answer may actually be a combination of what's here. That's probably my fault as much as any, because I suppose this is actually a compound question itself. I've considered posting my own answer and accepting it combining the available information about several devices, plus what I found about the exact affected DD-WRT build numbers, but I wonder if that's not kind of rude considering that you guys have supplied most of it and that way I deny EVERYONE the accepted answer rep. I know the accepted practise (from those meta.SO links) seems to be to pick a best one by my own conditions and upvote the rest (the latter of which is done), but different answers here are equally good for different parts of my question. Any thoughts? (Even, should this edit be a meta.sec question of it's own? I hesitate to do that when the question seems to be asked so many times already on other meta's)

Answer 1

I've found a nice post from a Cisco Support Engineer regarding to the ASA:

However, if you are trying to find the OpenSSL version for an ASA (Adaptive Security Appliance), you can determine this version from the ASA release notes. Simply examine the "Open Source" notes that are located in the release notes of the particular ASA image you are concerned with. For example, from the ASA 8.4 release notes, you will find a section titled "Related Documentation", which has a link that points to "ASA Series Documentation". From there, you will find a link for "Open Source License". That will take you to an "Open Source" page which reveals that the OpenSSL version that runs on the ASA 8.4 code is "0.9.8f"

Due to this neither 8.4(x) nor 9.1(x) are vulnerable as they are using parts of the OpenSSL version 0.9.8f

Answer 2

DD-WRT does use OpenSSL 1.0.1 and is vulnerable. There was an update posted just 22 hours ago to the trac page: http://svn.dd-wrt.com/browser/src/router/openssl

You can view the CHANGES file for details.

Answer 3

From Cisco Security Advisory on OpenSSL Heartbeat Extension Vulnerability in Multiple Cisco Products (Advisory ID: cisco-sa-20140409-heartbleed, April 9, 2014):

Vulnerable Product

The following Cisco products are affected by this vulnerability:

• Cisco AnyConnect Secure Mobility Client for iOS
• Cisco Desktop Collaboration Experience DX650
• Cisco Unified 7900, 8900, 9900 series IP Phones
• Cisco TelePresence Video Communication Server (VCS)

Other Cisco products may be affected by this vulnerability. The list of affected products will be updated as the investigation continues.

and

Products Confirmed Not Vulnerable

The following Cisco products have been analyzed and are not affected by this vulnerability:

• Cisco Adaptive Security Appliance (ASA) Software
• Cisco ACE Application Control Engine
• Cisco AnyConnect Secure Mobility Client for desktop platforms
• Cisco AnyConnect Secure Mobility Client for Android
• Cisco CSS 11500 Series Content Services Switches

Answer 4

On my DD-WRT router, access via ssh

First I could see that the version on the /usr/lib/libssl* is 0.9.8 Also running strings on said lib shows v 0.9.8 within

$ strings /usr/lib/libssl.so.0.9.8 | grep OpenS
OpenSSLDie
SSLv2 part of OpenSSL 0.9.8l 5 Nov 2009
SSLv3 part of OpenSSL 0.9.8l 5 Nov 2009
TLSv1 part of OpenSSL 0.9.8l 5 Nov 2009
DTLSv1 part of OpenSSL 0.9.8l 5 Nov 2009
OpenSSL 0.9.8l 5 Nov 2009

p.s. I also got EOF on filippo.io's tool, but thats just not implemented part of the test (http://filippo.io/Heartbleed/faq.html#wentwrong)

Answer 5

as far as DD-WRT goes, it depends on the version. A lot of the "current" DD-WRT releases pre-date the introduction of the heartbeat feature (2012) and associated security vulnerability into openssl. If your DD-WRT was built since 2012 it is vulnerable. The version of DD-WRT I am running on my internal routers is from 11/12 and when I run the heartbleed test I cloned from filippo.io against them I get "ERROR: EOF". :-/ My internet facing router (not running DD-WRT) is OK.

I also checked my synology which is running the version before the current release (5.0) and it is vulnerable. I've disabled access to it from the internet until synology releases a fix for this and I have a chance to apply it.

There is a list here:

https://isc.sans.edu/forums/diary/Heartbleed+vendor+notifications/17929

Answer 6

Synology is affected but is prepping an update for DSM 5 and DSM 4.3 tomorrow. A patch for DSM 4.2 will be delivered in one week.

From a release I got from Synology (I'm a journalist):

Synology® DSM 5.0 Secured Against OpenSSL Heartbleed Vulnerability

Taipei, Taiwan—April 11st, 2014—Synology® Inc. today releases the latest DSM 5.0-4458 Update 2 to resolve the vulnerability CVE-2014-0160 (also known as the Heartbleed bug) in the OpenSSL software.

As the OpenSSL is one of the largest encryption libraries on the Internet today and has been used by many websites, Synology has taken immediate actions to mitigate this issue:

• For DiskStation and RackStation running DSM 5.0 and DSM 4.3, it is strongly recommended to apply DSM 5.0-4458 Update 2 via Control Panel and renew SSL certification (read more in Security Advisory).
• For DiskStation or RackStation running DSM 4.2, patch will be delivered in one week.
• MyDS Center servers have been patched and are safe to use. However, MyDS Center users are strongly suggested to change MyDS password to ensure the safety of their personal information.

Synology values data & system security as one of its prime directive, and will continue devoting resources to equip our solutions with reliable security measures to prevent potential threats. If users need help with their systems after being upgraded to the latest DSM version or have any further questions, please contact [email protected].