topic I am running 4.5.0, it is in Network Security

Cisco Security Manager is vulnerable to CVE-2014-0160 - aka Heartbleed

ahmed.gadi — Fri, 21 Feb 2020 13:09:38 GMT

Dear All,

We have CSM 4.4.0 SP2 patch 1 installed with no default configuration.

According to cisco, CSM is under Vulnerable Products list with cisco bug ID CSCuo19265.

Do I need to take any action for my CSM ?

Thanks & Regards

Ahmed...

I recommend that you restrict

patoberli — Tue, 15 Apr 2014 07:45:38 GMT

I recommend that you restrict HTTPS access to the CSM server to the few clients that actually need access to it, until a fix has been released. That way you can at least restrict the amount of clients that could utilize this leak.

Hi Ahmed,CSM 4.4.0 SP2 patch

kshiva — Wed, 16 Apr 2014 04:37:47 GMT

Hi Ahmed,

CSM 4.4.0 SP2 patch 1 is not vulnerable to heartbleed. No action required for this specific version of CSM.

Given below is list of CSM versions that are vulnerable:

CSM 4.5
CSM 4.5 SP0 PP1
CSM 4.5 SP0 PP2

I am running 4.5.0, it is

Network Operation — Wed, 16 Apr 2014 04:43:29 GMT

I am running 4.5.0, it is vulnerable because I have scanned it and tested it. I see version 4.6.0 has just popped up on cisco.com. Anyone confirm if that fixes the bug?

CSM 4.6 has the fix and not

kshiva — Wed, 16 Apr 2014 04:56:07 GMT

CSM 4.6 has the fix and not vulnerable.

Im not sure if that's true.

ryancisco01 — Wed, 16 Apr 2014 05:00:29 GMT

Im not sure if that's true. the release notes don't state anything about fixing that big. and also looking at the opensource licenses PDF for 4.6.0 it states OpenSSL version: 1.0.1e (which is the same version as 4.5.0 and all versions 1a through 1f are vulnerable).

I would find it very odd they didn't fix it considering it was released just yesterday.

Will follow up and update the

kshiva — Wed, 16 Apr 2014 05:08:00 GMT

Will follow up and update the documentation with correct OpenSSL Version 1.0.1g. Heartbleed vulnerability is addressed in CSM 4.6

Great thanks for confirmation

ryancisco01 — Wed, 16 Apr 2014 05:40:57 GMT

Great thanks for confirmation.

Many thanks

ahmed.gadi — Wed, 16 Apr 2014 09:27:56 GMT

Many thanks

When will the patch to

Tan Stanley — Wed, 16 Apr 2014 13:51:55 GMT

When will the patch to resolve heartbleed issue in csm 4.5 be out??

CSM 4.5 CP3 is out and it

dbrockus — Mon, 21 Apr 2014 03:56:10 GMT

CSM 4.5 CP3 is out and it fixes the heartbleed vulnerability.

Request CSM450_SP0_CP3_bundle.zip from TAC