OPENSSL SECURITY ISSUE

[Chet Cronin]

I have systems running various firmware versions including:

F9.3.4 (MXP Series)

TC7.3.X (Series)

CE8.2.1 (Series)

X8.8.2  (VCS)

X8.5.1 (VCS)

4.5(1.71) (Codian)

4.5(1.89) (Codian)

J4.7 (MPS)

2.0.1 (Acano/CMS)

We have been directed to upgrade SSL to current Version which I believe is 1.0.1g on all systems that need it.

What firmware versions are using the current version of SSL?

Can I upgrade F9.3.4 locally and if so what is the procedure please ?

If I have to upgrade  VCS, Codian, and MPS versions, Acano/CMS what is the procedure please ?

VR

Chet

[Wayne DeNardi]

You cannot individually update a component (like SSL) on any of the devices, you need to upload a complete software kit.

There is no further upgrade for the old MXP devices - F9.3.4 is the latest on those old devices.

For the others - just update to the latest software version availabel for each (TC7.3.9 / CE9.0.1 / X8.9.2, etc).

Wayne
--
Please remember to rate responses and to mark your question as answered if appropriate.

[Chet Cronin]

Roger that ... looks like we will be replacing the MXP1700's with POLYCOM's Real Presence Desktops.  Got a few hundred of them too.  Hopefully that clears the vulnerabilities. 

Thank you for the update. 

VR

Chet

[Patrick Sparkman]

Here is the last Cisco Security Advisory, cisco-sa-20170130-openssl,  which can help determine the latest OpenSSL version on some devices, either by being affected by the advisory or doesn't apply (which might mean they're running a version that already contains the fix).

The upgrade process for software is covered in the admin guides and/or release notes for each product.  Most can be done through the web interface, however Acano/CMS requires you to use SFTP and the MMP interface.