====== CVE-2014-0160 OpenSSL Heartbleed Vulnerability======

===== About Networking Vendors =====
^ Vendor      ^ Affected       ^ Announcement          ^ Announce Date ^
| A10  | None |[[https://www.a10networks.com/vadc/index.php/a10-products-not-vulnerable-to-openssl-cve-2014-0160-heartbleed/|External link at A10]]  | 2014-04-09 |
| Arbor Networks | None | [[https://arbor.custhelp.com/app/answers/detail/a_id/2320/kw/2320|Internal Field Notification Only (login required)]] | 2014-04-15 |
| Aruba Networks | Few Version | [[http://www.arubanetworks.com/support/alerts/aid-040814.asc|External Document at Aruba Alert]] | 2014-04-08 |
| BlueCoat | Few Version & Platform | [[https://kb.bluecoat.com/index?page=content&id=SA79&actp=LIST|External link at BlueCoat KB]]  | 2014-04-09 |
| Brocade | None | [[http://community.brocade.com/t5/Campus-Networks/Brocade-Products-and-Website-NOT-Affected-by-Heartbleed/ba-p/59450|External link at Brocade]] | 2014-04-16 |
| CheckPoint | Verifing... | [[https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk100173|External link at CheckPoint]] | 2014-04-08 |
| Cisco | Verifing... | [[http://www.cisco.com/web/about/security/intelligence/ERP-Heartbleed.html|External link at Cisco]] | 2014-04-09 |
| Dlink | Being Confirmed…  | | |
| Enterasys (Part of Extreme) | Being Confirmed… | | |
| Extreme Networks | Few Products | [[https://community.extremenetworks.com/extreme/topics/response_to_heartbleed_cve_2014_0160_openssl_vulnerability_article_id_16130/|External link at Extreme]] | 2014-04-14 |
| F5 | Few Version | [[http://support.f5.com/kb/en-us/solutions/public/15000/100/sol15159.html|External link at F5]]  [[https://devcentral.f5.com/articles/ssl-heartbleed-irule-update#.U0btTle1Yeo|Detect Attack iRule]] | 2014-04-08 |
| FireEye | Few Product | [[http://www.fireeye.com/support/support-notices.html|External link at FireEye]] | 2014-04-16 |
| Fortinet | Few Version & Platform | [[http://www.fortiguard.com/advisory/FG-IR-14-011/|External link at FortiGuard]] | 2014-04-08 |
| iMPERVA | Only v10.5 | [[https://www.imperva.com/sign_in.asp?retURL=/articles/Reference/CVE-2014-0160-OpenSSL-HeartBleed-Vulnerability| External link at iMPERVA (login required)]] | 2014-04-11 |
| Juniper | Multi Platform :!: | [[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10623&actp=SUBSCRIPTION|External link at Juniper KB]]  | 2014-04-08 |
| McAfee | Multi Products | [[https://kc.mcafee.com/corporate/index?page=content&id=SB10071|External link at McAfee]] | 2014-04-08 | 
| NetAxle | None | [[http://www.netaxle.com.tw/|External link at NetAxle]] | -- |
| Palo Alto | None | [[http://researchcenter.paloaltonetworks.com/2014/04/palo-alto-networks-addresses-heartbleed-vulnerability-cve-2014-0160/|External link at Palo Alto]] | 2014-04-09 |
| Ruckus Wireless | Only "Smart Cell Gateway" | [[http://www.ruckuswireless.com/security| External link at Ruckus Security]] | 2014-04-14 |
| Sophers | Few Version | [[http://blogs.sophos.com/2014/04/08/important-note-openssl-vulnerability-cve-2014-0160-in-sophos-utm/|External link at Sophers]] | 2014-04-08 |
| Sourcefire (Part of Cisco) | | Check Cisco | |
| Splunk | Few Version | [[http://answers.splunk.com/answers/130943/openssl-security-bug| External link at Splunk Answers ]]  | 2014-04-09 |
| TippingPoint | None | [[https://tmc.tippingpoint.com/TMC/library/announcements/heartbleed_openssl_vulnerability.pdf|PDF at TMC]] | 2014-04-09 |
| VMware | Multi Version :!: | [[http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2076225|External link at VMware KB]] | 2014-04-09 |
| Websense | Few Version | [[http://www.websense.com/support/article/kbarticle/Heartbleed-OpenSSL-Vulnerability|External link at Websense ]] | 2014-04-09 |

===== Best Practices =====
  * Upgrade if possible (if not, then disable heartbeats)
  * Revoke all current keys and replace them with new ones
  * Reissue certificate and revocation old certificate
  * Change any credentials that may have been loaded into memory by the vulnerable processes

===== Further Reading =====
  * [[https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160]]
  * [[http://devco.re/blog/2014/04/11/openssl-heartbleed-how-to-hack-how-to-protect/|OpenSSL Heartbleed 全球駭客的殺戮祭典，你參與了嗎？ ]]
  * [[http://devco.re/blog/2014/04/09/openssl-heartbleed-CVE-2014-0160/|OpenSSL CVE-2014-0160 Heartbleed 嚴重漏洞]]
  * [[http://d.hatena.ne.jp/Kango/20140410/1397139257]]