ID

VAR-201404-0592

CVE

CVE-2014-0160

TITLE

OpenSSL TLS heartbeat extension read overflow discloses sensitive information

DESCRIPTION

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug. OpenSSL 1.0.1 and 1.0.2 beta contain a vulnerability that could disclose sensitive private information to an attacker. This vulnerability is commonly referred to as "heartbleed.". -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: rhev-hypervisor6 security update Advisory ID: RHSA-2014:0396-01 Product: Red Hat Enterprise Virtualization Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-0396.html Issue date: 2014-04-10 CVE Names: CVE-2014-0160 ===================================================================== 1. Summary: An updated rhev-hypervisor6 package that fixes one security issue is now available for Red Hat Enterprise Virtualization Hypervisor 3.2. The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: RHEV Hypervisor for RHEL-6 - noarch 3. Description: The rhev-hypervisor6 package provides a Red Hat Enterprise Virtualization Hypervisor ISO disk image. The Red Hat Enterprise Virtualization Hypervisor is a dedicated Kernel-based Virtual Machine (KVM) hypervisor. It includes everything necessary to run and manage virtual machines: a subset of the Red Hat Enterprise Linux operating environment and the Red Hat Enterprise Virtualization Agent. Important: This update is an emergency security fix being provided outside the scope of the published support policy for Red Hat Enterprise Virtualization listed in the References section. In accordance with the support policy for Red Hat Enterprise Virtualization, Red Hat Enterprise Virtualization Hypervisor 3.2 will not receive future security updates. Note: Red Hat Enterprise Virtualization Hypervisor is only available for the Intel 64 and AMD64 architectures with virtualization extensions. An information disclosure flaw was found in the way OpenSSL handled TLS and DTLS Heartbeat Extension packets. A malicious TLS or DTLS client or server could send a specially crafted TLS or DTLS Heartbeat packet to disclose a limited portion of memory per request from a connected client or server. (CVE-2014-0160) Red Hat would like to thank the OpenSSL project for reporting this issue. Upstream acknowledges Neel Mehta of Google Security as the original reporter. Users of the Red Hat Enterprise Virtualization Hypervisor are advised to upgrade to this updated package, which corrects this issue. 4. Solution: This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258 To upgrade Hypervisors in Red Hat Enterprise Virtualization environments using the disk image provided by this package, refer to: https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Hypervisor_Deployment_Guide/chap-Deployment_Guide-Upgrading_Red_Hat_Enterprise_Virtualization_Hypervisors.html 5. Bugs fixed (https://bugzilla.redhat.com/): 1084875 - CVE-2014-0160 openssl: information disclosure in handling of TLS heartbeat extension packets 1085357 - Packaging of RHEV-H for RHEV 3.2.6 ASYNC 6. Package List: RHEV Hypervisor for RHEL-6: noarch: rhev-hypervisor6-6.5-20140118.1.3.2.el6_5.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2014-0160.html https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/site/support/policy/updates/rhev/ 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c04263236 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04263236 Version: 2 HPSBMU03022 rev.2 - HP Systems Insight Manager (SIM) Bundled Software running OpenSSL, Remote Disclosure of Information NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2014-04-25 Last Updated: 2014-05-13 Potential Security Impact: Remote disclosure of information Source: Hewlett-Packard Company, HP Software Security Response Team VULNERABILITY SUMMARY A potential security vulnerability has been identified with HP Systems Insight Management (SIM) bundled software running OpenSSL. The HP SIM software itself is not vulnerable to CVE-2014-0160 ("Heartbleed"). However, the software components bundled with HP SIM are impacted and should be addressed if installed. References: CVE-2014-0160, SSRT101527 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP Systems Insight Manager 7.2, 7.2.1, 7.2.2, 7.3, and 7.3.1 bundled with the following software: HP Smart Update Manager (SUM) 6.0.0 through 6.3.0 HP System Management Homepage (SMH) v7.1.2, v7.2, v7.2.1, v7.2.2, v7.3, v7.3.1 for Linux and Windows WMI Mapper for HP Systems Insight Manager v7.2.1, v7.2.2, v7.3, and v7.3.1 HP Version Control Agent (VCA) v7.2.0, v7.2.1, v7.2.2, v7.3.0, and v7.3.1 for Windows HP Version Control Agent (VCA) v7.2.2, v7.3.0, and v7.3.1 for Linux HP Version Control Repository Manager (VCRM) v7.2.0, v7.2.1, v7.2.2, v7.3.0, and v7.3.1 for Windows BACKGROUND CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2014-0160 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION HP has addressed this vulnerability for the impacted software components bundled with HP Systems Insight Manager (SIM) in the following HP Security Bulletins: HP SIM Component HP Security Bulletin Security Bulletin Location HP Smart Update Manager (SUM) HPSBMU02997 https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_ na-c04239375 HP System Management Homepage (SMH) HPSBMU02998 https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_ na-c04239372 WMI Mapper for HP Systems Insight Manager HPSBMU03013 https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_ na-c04260385 HP Version Control Agent (VCA) and Version Control Repository Manager (VCRM) on Linux and Windows, HPSBMU03020 https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_ na-c04262472 Note: If customers believe that the SIM installation was compromised while it was running components vulnerable to Heartbleed they need to take the following actions once they have upgraded to the non-vulnerable components. This includes revoking, recreating, and re-importing certificates and resetting passwords that might have been harvested by a malicious attacker using the Heartbleed vulnerability. HP has made the following hot fixes available for SIM v7.2.x that fix the Heartbleed vulnerability: The HP SIM 7.2 Hotfix Kit is available in the following location and is applicable to HP SIM 7.2.x installations. Please read through the readme.txt file before proceeding with the installation. Please click on the HP SIM 7.2 HotFix Kit link to download the hot fix for your operating system platform: http://h18013.www1.hp.com/products/servers/management/hpsim/download.html After installing SIM72_hotfix_2014_Apr_win.exe hotfix, HP Systems Management Homepage has to be manually upgraded if it is already installed on the CMS. HP SMH installer for 32-bit and 64-bit can be found in the CMS under the location SIM_INSTALL_DIR\smartcomponents . The installer filenames are cp023242.exe and cp023243.exe. In case it is suspected that the infrastructure has been compromised, the user needs to create new HP SIM Server certificate and Single Sign-on (sso) certificates. To create new server and sso certificates, refer the HP SIM 7.2 Command Line Interface guide which can be found in the below URL: ttp://h17007.www1.hp.com/us/en/enterprise/servers/solutions/info-library/inde x Refer to the mxcert command section which has the details to create new server and sso certificates. Once the new server certificate is created, it will invalidate any trust relationship between CMS and any other system that depend on this certificate, such as browsers. The user must re-establish the trust between CMS and other system that uses this certificate, and revoke any previous SIM certificates from any device previously configured to trust SIM (Onboard Administrator, Virtual Connect Module, iLOs, and SMH instances). Once the new sso certificate is created, the user must re-establish the trust between HP SIM and managed devices (HP SMH, ILO, OA. VC) for Single Sign-on to work. To reestablish trust with the sso certificate, refer to HP SIM 7.2 user guide and HP SIM Online help (under security section). HP SIM 7.2 user guide is located in the below URL: http://h20628.www2.hp.com/km-ext/kmcsdirect/emr_na-c03651392-3.pdf HP SIM 7.3 user guide is located in the below URL: http://h20628.www2.hp.com/km-ext/kmcsdirect/emr_na-c04030739-2.pdf CMS Reconfigure Tool (aka mxrefconfig) In case it is suspected that CMS OS credentials are also compromised, then it is recommended that credentials are changed. The SIM User Guide (Chapter 19 CMS Reconfigure Tool pg 93) provides two procedures to change the service account password along with other related accounts. The procedures to follow are: Procedure 18 - Changing the CMS password for HP SIM and Insight Control Procedure 19 - Changing CMS password for Matrix OE and Operations Orchestration Note: if the customer has Insight Control server deployment installed, procedures to change the password are documented in the HP Insight Control Server Deployment User Guide. Frequently Asked Questions: Will updated systems require a reboot after applying the SIM hotfix? No, reboot of the system will not be required. Installing the new build would be sufficient to get back to the normal state. Will new certificates be issued along with the patch, or need to be handled separately? If you suspect the certificate has been compromised due to this vulnerability, we do recommend creating new certificates for server and Single Sign-on and revoking previous certificates. Instructions on creating new certificate and re-establishing trust between CMS and managed devices are in the notes above. - From where can I get HP SIM documentation? All major documents are available at: http://h17007.www1.hp.com/us/en/enterprise/servers/solutions/info-library/ind ex.aspx?cat=insightmanagement&subcat=sim#.U2yioSi20tM HISTORY Version:1 (rev.1) - 25 April 2014 Initial release Version:2 (rev.2) - 13 May 2014 Added additional remediation steps and v7.2 Hotfix Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com. Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins Security Bulletin Archive: A list of recently released Security Bulletins is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/ Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HP General Software HF = HP Hardware and Firmware MP = MPE/iX MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PI = Printing and Imaging PV = ProCurve ST = Storage Software TU = Tru64 UNIX UX = HP-UX Copyright 2014 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) iEYEARECAAYFAlNyXGAACgkQ4B86/C0qfVmjYgCggwxWeqRDnEyVKK5E1ZRxB5Lh kYwAnj6XwjTIE82rjAsetI1Af/VO2tsC =XSLk -----END PGP SIGNATURE----- . HP CloudSystem Matrix 7.3 Update 1 v7.3.1.0 and HP CloudSystem built on ConvergedSystem 700x solutions support customers moving from OA 4.11 to OA 4.12. Please see the table below. To obtain the updated firmware, follow the below steps to obtain the firmware Update. Obtain the firmware update from www.hp.com/go/support Select "Drivers & Downloads". Enter the product name listed in the table below into the search field. Click on "Go". Click on the appropriate product. Under "Select operating system" select any Windows operating system from the list. Select the appropriate firmware update under "Firmware". The Virtual Connect firmware itself is not vulnerable to CVE-2014-0160 (Heartbleed), however, the installer component in versions 4.10 and 4.20 of Virtual Connect does have the vulnerability, and should be replaced with versions 4.10b or 4.20b, or the latest version of Virtual Connect Support Utility referenced below. The VCSU vulnerability is only present during the firmware upgrade process. Until the firmware updates are available, HP recommends that customers disable the HTTPS management protocol and instead manage the device securely using SSH, and disable the secure SMI-S protocol and use the unsecured SMI-S protocol if desired. After the protocols have been disabled, change the user passwords on the array. HP Multimedia Service Environment (MSE) 2.1.1 HP Network Interactive Voice Response (NIVR) 2.1.0, Reactive Patches 001, 002, 003 HP Network Interactive Voice Response (NIVR) 2.0.7, Reactive Patch 003 Only the MSE (ACM TMP) database set up with Replication using SSL is impacted for the above versions. This bulletin will be revised when the software updates are released. References: CVE-2009-3555 Unauthorized Modification CVE-2014-0160 Heartbleed - Disclosure of Information CVE-2014-0195 Remote Code Execution, Denial of Service (DoS) CVE-2014-3505 Heartbleed - Remote Denial of Service (DoS) CVE-2014-3506 Heartbleed - Remote Denial of Service (DoS) CVE-2014-3507 Heartbleed - Remote Denial of Service (DoS) CVE-2014-3508 Heartbleed - Remote Denial of Service (DoS) CVE-2014-3509 Heartbleed - Remote Denial of Service (DoS) CVE-2014-3510 Heartbleed - Remote Denial of Service (DoS) CVE-2014-3511 Heartbleed - Remote Denial of Service (DoS) CVE-2014-3512 Heartbleed - Remote Denial of Service (DoS) CVE-2014-3566 POODLE - Remote Disclosure of Information CVE-2014-5139 Shellshock - Remote Denial of Service (DoS) SSRT101846 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. OpenSSL is a 3rd party product that is embedded with some of HP Software products. This bulletin objective is to notify HP Software customers about products affected by the Heartbleed vulnerability. This weakness potentially allows disclosure of information protected, under normal conditions, by the SSL/TLS protocol. The impacted products appear in the list below are vulnerable due to embedding OpenSSL standard release software. Each bulletin will include a patch and/or mitigation guideline. Note: OpenSSL is an external product embedded in HP products. Bulletin Applicability: This bulletin applies to each OpenSSL component that is embedded within the HP products listed in the security bulletin. The bulletin does not apply to any other 3rd party application (e.g. operating system, web server, or application server) that may be required to be installed by the customer according instructions in the product install guide. To learn more about HP Software Incident Response, please visit http://www8.h p.com/us/en/software-solutions/enterprise-software-security-center/response-c enter.html . HP Diagnostics 9.23 and 9.23 IP1 BACKGROUND CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2014-0160 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION Customers should download Diagnostics 9.23 IP #2 Patch: Diag Servers: HP Software Support Online Diag Server 9.23 IP2 for Linux32 http://support.openview.hp.com/selfsolve/document/LID/DIAGSRV_00062 Diag Server 9.23 IP2 for Linux64 http://support.openview.hp.com/selfsolve/document/LID/DIAGSRV_00063 Diag Server 9.23 IP2 for Solaris http://support.openview.hp.com/selfsolve/document/LID/DIAGSRV_00064 Diag Server 9.23 IP2 for Win32 http://support.openview.hp.com/selfsolve/document/LID/DIAGSRV_00065 Diag Server 9.23 IP2 for Win64 http://support.openview.hp.com/selfsolve/document/LID/DIAGSRV_00066 Diag Collectors: Diag Collector 9.23 IP2 for Linux32 http://support.openview.hp.com/selfsolve/document/LID/DIAGCOL_00059 Diag Collector 9.23 IP2 for Solaris32 http://support.openview.hp.com/selfsolve/document/LID/DIAGCOL_00060 Diag Collector 9.23 IP2 for Unix32 http://support.openview.hp.com/selfsolve/document/LID/DIAGCOL_00061 Diag Collector 9.23 IP2 for Windows http://support.openview.hp.com/selfsolve/document/LID/DIAGCOL_00062 Diag Agents: Diag Python Agent 9.23 IP2 http://support.openview.hp.com/selfsolve/document/LID/DIAGPRB_00109 Diag .NET Agent 9.23 IP2 for Win32 http://support.openview.hp.com/selfsolve/document/LID/DIAGPRB_00110 Diag .NET Agent 9.23 IP2 for Win64 http://support.openview.hp.com/selfsolve/document/LID/DIAGPRB_00111 Diag Java Agent 9.23 IP2 for Linux/Unix/Solaris http://support.openview.hp.com/selfsolve/document/LID/DIAGPRB_00112 Diag Java Agent 9.23 IP2 http://support.openview.hp.com/selfsolve/document/LID/DIAGPRB_00113 Diag Java Agent 9.23 IP2 for zOS http://support.openview.hp.com/selfsolve/document/LID/DIAGPRB_00114 HP recommends completing the following action items: Revocation of the old key pairs that were just superseded Changing potentially affected passwords Invalidating all session keys and cookies Bulletin Applicability: This bulletin applies to each OpenSSL component that is embedded within the HP products listed in the security bulletin. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software Advisory ID: cisco-sa-20140430-tcte Revision 1.0 For Public Release 2014 April 30 16:00 UTC (GMT) Summary ======= Cisco TelePresence TC and TE Software are affected by the following vulnerabilities: Six Session Initiation Protocol (SIP) denial of service vulnerabilities Cisco TelePresence TC and TE Software DNS Buffer Overflow Vulnerability Cisco TelePresence TC and TE Software Input Validation Vulnerability Cisco TelePresence TC and TE Software tshell Command Injection Vulnerability Cisco TelePresence TC and TE Software Heap Overflow Vulnerability Cisco TelePresence TC and TE Software U-Boot Buffer Overflow Vulnerability Cisco TelePresence TC and TE Software Unauthenticated Serial Port Access Vulnerability Cisco TelePresence TC H.225 Denial of Service Vulnerability Successful exploitation of these vulnerabilities could allow an attacker to cause the affected system to reload, execute arbitrary commands or obtain privileged access to the affected system. There are no workarounds that mitigate these vulnerabilities. Install HP Management Agents for Windows x86/x64 Install HP Management Agents for RHEL 5 x64 Install HP Management Agents for RHEL 6 x64 Install HP Management Agents for SLES 10 x64 Install HP Management Agents for SLES 11 x64 References: CVE-2014-0160 (SSRT101538) SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP has provided manual update steps if version upgrading is not possible. Delete the smhamd64-*.exe/smhx86-*.exe" from Component Copy Location listed in the following table, row 1,2,3,4. Delete the affected hpsmh-7.*.rpm" from Component Copy Location listed in the following table, row 5. In sequence, perform the steps from left to right in the following table. First, download components from Download Link; Second, rename the component as suggested in Rename to. Third, copy the component to the location suggested in Component Copy Location. Table Row Number Download Link Rename to Component Copy Location 1 http://www.hp.com/swpublishing/MTX-d1488fd987894bc4ab3fe0ef52 smhx86-cp023242.exe \\express\hpfeatures\hpagents-ws\components\Win2003 2 http://www.hp.com/swpublishing/MTX-4575754bbb614b58bf0ae1ac37 smhamd64-cp023243.exe \\express\hpfeatures\hpagents-ws\components\Win2003 3 http://www.hp.com/swpublishing/MTX-37075daeead2433cb41b59ae76 smhamd64-cp023341.exe \\express\hpfeatures\hpagents-ws\components\Win2008 4 http://www.hp.com/swpublishing/MTX-27e03b2f9cd24e77adc9dba94a smhx86-cp023340.exe \\express\hpfeatures\hpagents-ws\components\Win2008 5 http://www.hp.com/swpublishing/MTX-bfd3c0fb11184796b9428ced37 Do not rename the downloaded component for this step. \\express\hpfeatures\hpagents-sles11-x64\components \\express\hpfeatures\hpagents-sles10-x64\components \\express\hpfeatures\hpagents-rhel5-x64\components \\express\hpfeatures\hpagents-rhel6-x64\components Initiate Install HP Management Agents for SLES 11 x64 on targets running SLES11 x64. Initiate Install HP Management Agents for SLES 10 x64 on targets running SLES10 x64. Initiate Install HP Management Agents for RHEL 6 x64 on targets running RHEL 6 x64. Initiate Install HP Management Agents for RHEL 5 x64 on targets running RHEL 5 x64. Initiate Install HP Management Agents for Windows x86/x64 on targets running Windows. Description: OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols, as well as a full-strength, general purpose cryptography library. For the update to take effect, all services linked to the OpenSSL library (such as httpd and other SSL-enabled services) must be restarted or the system rebooted. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

TYPE

overflow

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

HP

SOURCES

LAST UPDATE DATE

2026-03-17T20:29:06.304000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE