VCS and How to Update OpenSSL to Protect from HeartBleed Vulnerability

[kep224]

Hello,

This will probably be best addressed via a service ticket to Cisco, but thought I'd start here.

The vulnerability described here: http://heartbleed.com/ is definitely in our VCS infrastructure- perhaps as a Cisco variant, but definitely present. Is this something that Cisco typically will release a patch for, or are we supposed to update the box as like any other Linux based system. I'm concerned with warranty implications.

Thanks for any help!

-Kyle

[dpetrovi]

Hi Kyle,

The Cisco PSIRT is investigating the impact of this vulnerability on Cisco products and will disclose any vulnerabilities according to our security policy, which is available at http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html . 

An INTERIM Cisco Security Advisory was published on April 9th, 2014 at 0300 UTC and is available at http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-heartbleed .

The Cisco PSIRT will update this Cisco Security Advisory as more information becomes available.

If the product is vulnerable, rest assured that we will address it appropriately. 

I hope this helps.

-Dejan

P.S. This specific community is for Cisco Unified MeetingPlace and Cisco WebEx Meetings Server products. For any further queries for VCS, I advise you to post them in Telepresence community to get the best possible assistance.