Cyberoam Urges Customers to Upgrade over Heartbleed Vulnerability

The OpenSSL team, on Monday, released a critical update for their popular SSL/TLS package (OpenSSL 1.0.1g), which fixed the OpenSSL Heartbleed Vulnerability.

Cyberoam, like many others also use OpenSSL, but Cyberoam said it was happy to announce that none of its GA Versions are affected, as they are not running on these compromised versions of OpenSSL.

However, as only Beta versions which are available to a limited number their customers are affected, Cyberoam released a firmware upgrade 10.6.1 RC-4 on April 12, 2014.

Cyberoam urged that all the customers using the affected versions to upgrade to this version immediately.

Heartbleed Vulnerability, Nigeria CommunicationsWeek gathered, entails that an information disclosure vulnerability, CVE-2014-0160), was discovered in 1.0.1 and 1.0.2-beta releasing OpenSSL versions including 1.0.1f and 1.0.2-beta1.

This vulnerability, Cyberoam explained, is due to a missing bounds check in the handling of the Transport Layer Security (TLS) heartbeat extension.

The vulnerability, thus, may allow an attacker to retrieve memory in chunks of 64 kilobytes from a connected client or server.

This means, an attacker can access sensitive information (read: private keys, login credentials for Internet Banking, Emails, Social Networking sites etc. or contents of encrypted traffic) from a connected client or server by sending specially-crafted TLS “heartbeat” requests.

The vulnerability is fixed in firmware 10.6.1 RC-4 and Cyberoam has released the firmware upgrade for the affected CyberoamOS versions on April 12, 2014.

To mitigate the heartbleed vulnerability, Cyberoam has released IPS Signature Versions 3.11.61 and 5.11.61 containing an IPS signature named “OpenSSL TLS DTLS Heartbeat Information Disclosure”.

By default, once the IPS policy with signature “OpenSSL TLS DTLS Heartbeat Information Disclosure” is applied through Firewall, all the SSL connections attempting to exploit the said vulnerability will be dropped.

“We request all Cyberoam customers to verify the version of IPS Signature from the Dashboard of their Appliances.

“After upgrading or taking steps to mitigate this vulnerability, Cyberoam also recommends all the customers to apply the fix provided by the OpenSSL team in their applications such as Web services etc. which use the comprised versions of OpenSSL.

“Cyberoam recommends to disable all the non mission-critical SSL services and applications running on the compromised OpenSSL versions,” the email read.