cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Former Member
Not applicable
Report Inappropriate Content
Message 21 of 27

Re: OpenSSL CVE-2014-0160

Jump to solution

Hello

Now this is the definitive answer:

Security Bulletin

https://kc.mcafee.com/corporate/index?page=content&id=SB10071

"What to do after upgrading Web Gateway to combat Heartbleed"

https://kc.mcafee.com/corporate/index?page=content&id=KB81669

Well a lot of work to do...

View solution in original post

timode
Level 9
Report Inappropriate Content
Message 22 of 27

Re: OpenSSL CVE-2014-0160

Jump to solution

Hi,

I'm just wondering if I really have to renew my CA for SSL-Scanning. We use a Sub-CA from our company CA. As far as I know MWG issues certificates for each http-Request for each FQDN (and caches them). So wouldn't it be sufficient to clear the certificate cache to make MWG issue new certificates for each FQDN?

cheers

Timo

asabban
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 23 of 27

Re: OpenSSL CVE-2014-0160

Jump to solution

Hello,

when you access a website MWG creates a server certificate for that website and signs it with the CA you have configured. To do so MWG needs to load the CA certificate and the private key. This means that information is available in the memory. The memory can be read by an attacker in 64kb chunks, so theoretically it might be possible that someone got access to the private key. That means the CA is compromised and someone who stole it could sign certificates with that CA.

To be secure the best approach would be to have your company CA sign a new Sub-CA , import that into MWG and revoke the old Sub-CA. Because the browsers trust the company CA there shouldn't be a need to distribute a new CA to the clients.

Best,

Andre

Former Member
Not applicable
Report Inappropriate Content
Message 24 of 27

Re: OpenSSL CVE-2014-0160

Jump to solution

Hello Timo

I would not continue to use the SubCA certificate. I am going to revoke it.

Consider this:

Someone was able to steal the private key of the SubCA Cert then it is possible to sign new certificates for whatever purpose. That is the reason why in my opinion it is best to revoke this certificate.

What I have seen on a test system:

After the update is finished it cleans out the old certificates that were issued by the SubCA.

According to release notes a reboot is needed to ensure that no running process continues to use the old OpenSSL libraries, but the update does not indicate that a reboot is needed.

Andre was faster

Message was edited by: sthe / Andre was faster on 4/11/14 2:01:29 PM CEST
Former Member
Not applicable
Report Inappropriate Content
Message 25 of 27

Re: OpenSSL CVE-2014-0160

Jump to solution

Any news about Web Gateway 6.9.x?  Yes I know, it's the next thing to migrate but it is still in place as IronMail 6.7.x.  For Ironmail, the info is just out, 6.7 is ok but nothing on WebWasher 6.9 yet.

Former Member
Not applicable
Report Inappropriate Content
Message 26 of 27

Re: OpenSSL CVE-2014-0160

Jump to solution

Done the test finally and WebWasher 6.9.6 do not have the affected librairie it seem:

[root@___ ~]# rpm -qa openssl

openssl-0.9.7g-cg13

[root@___ ~]# yum list openssl

Loading "installonlyn" plugin

Setting up repositories

cglinux-base                                                         [1/3]

cglinux-base              100% |=========================|  951 B    00:00

cglinux-updates                                                      [2/3]

cglinux-updates           100% |=========================|  951 B    00:00

webwasher-updates                                                    [3/3]

webwasher-updates         100% |=========================|  951 B    00:00

Reading repository metadata in from local files

Installed Packages

openssl.i586                             0.9.7g-cg13            installed

asabban
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 27 of 27

Re: OpenSSL CVE-2014-0160

Jump to solution

That is correct. Unfortunately the EOLed versions have not been explicitly mentioned in the announcements.

Best,

Andre

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community