Hello
Now this is the definitive answer:
Security Bulletin
https://kc.mcafee.com/corporate/index?page=content&id=SB10071
"What to do after upgrading Web Gateway to combat Heartbleed"
https://kc.mcafee.com/corporate/index?page=content&id=KB81669
Well a lot of work to do...
Hi,
I'm just wondering if I really have to renew my CA for SSL-Scanning. We use a Sub-CA from our company CA. As far as I know MWG issues certificates for each http-Request for each FQDN (and caches them). So wouldn't it be sufficient to clear the certificate cache to make MWG issue new certificates for each FQDN?
cheers
Timo
Hello,
when you access a website MWG creates a server certificate for that website and signs it with the CA you have configured. To do so MWG needs to load the CA certificate and the private key. This means that information is available in the memory. The memory can be read by an attacker in 64kb chunks, so theoretically it might be possible that someone got access to the private key. That means the CA is compromised and someone who stole it could sign certificates with that CA.
To be secure the best approach would be to have your company CA sign a new Sub-CA , import that into MWG and revoke the old Sub-CA. Because the browsers trust the company CA there shouldn't be a need to distribute a new CA to the clients.
Best,
Andre
Hello Timo
I would not continue to use the SubCA certificate. I am going to revoke it.
Consider this:
Someone was able to steal the private key of the SubCA Cert then it is possible to sign new certificates for whatever purpose. That is the reason why in my opinion it is best to revoke this certificate.
What I have seen on a test system:
After the update is finished it cleans out the old certificates that were issued by the SubCA.
According to release notes a reboot is needed to ensure that no running process continues to use the old OpenSSL libraries, but the update does not indicate that a reboot is needed.
Andre was faster
Message was edited by: sthe / Andre was faster on 4/11/14 2:01:29 PM CESTAny news about Web Gateway 6.9.x? Yes I know, it's the next thing to migrate but it is still in place as IronMail 6.7.x. For Ironmail, the info is just out, 6.7 is ok but nothing on WebWasher 6.9 yet.
Done the test finally and WebWasher 6.9.6 do not have the affected librairie it seem:
[root@___ ~]# rpm -qa openssl
openssl-0.9.7g-cg13
[root@___ ~]# yum list openssl
Loading "installonlyn" plugin
Setting up repositories
cglinux-base [1/3]
cglinux-base 100% |=========================| 951 B 00:00
cglinux-updates [2/3]
cglinux-updates 100% |=========================| 951 B 00:00
webwasher-updates [3/3]
webwasher-updates 100% |=========================| 951 B 00:00
Reading repository metadata in from local files
Installed Packages
openssl.i586 0.9.7g-cg13 installed
That is correct. Unfortunately the EOLed versions have not been explicitly mentioned in the announcements.
Best,
Andre
Corporate Headquarters
6220 America Center Drive
San Jose, CA 95002 USA