ePO - OpenSSL versions (CVE-2014-0160)

[brettmartinez]

Unfortunately bouncing the box didn't resolve the issue. I agree with your statement on the risk. The potential data loss her is minimal and was looking for aquick  fix in waiting for McAfee to deliver an approved solution.

[deelight]

Interesting that you got those results. We replaced the .exe and dll on a few of our ePO boxes as a test, then rebooted them and rescanned with updated Nexpose (they updated the signatures for this again today) and scan clean for CVE-2014-0160.  After seeing your post I also checked our public ones against  http://filippo.io/Heartbleed/ and it also reports them as clean.

[tcox8]

After doing the file replacement as mentioned before, our security team scanned the server and it came back clean. Note: you must use the 32 bit version of 1.0.1g not the 64 bit version. When I tried at first with 64 bit it did not work. Had to use the 32 bit binaries.

[RRMX]

Excellent point tcox8, thanks for mentioning that. I used the 32bit versions as well.

[dolchy]

Running ePO 4.6.7 and confirmed OpenSSL version as 1.0.1e which is affected, but not listed on the latest SNS. I'm a bit perplexed as well.

[mgg]

Unlikely to get a 'official' confirmation of the impacted status until a patch is ready. Nature of the beast

Recommend contextual risk assessment and action appropriate to your envrionment.

[jickfoo]

Still nothing ? Well no big deal. Not like they are a security company or anything. Oh wait..

[JoeBidgood]

Hotfixes for ePO versions are now available: please see the updated bulletin at SB10071  for details.

Regards -

Joe

[Namster · Accepted solution]

Hey everyone, I'll try to simplify the steps for you all:

1. Download the Hotfix
2. Backup your ePO server KB71825
   1. Make sure you follow the KB
3. Update the ePO server KB71825
   1. Update the Agent Handler(s) if applicable
4. Change the SQL Password, and update on ePO and AH with the new passwords.
5. Create new agent-server communication keys KB81674
6. Create a daily task for MA - Product Update - "ePO Agent Key Updater"
   1. Monitor, backup and retire old keys accordingly.
   2. Create new agent package for distribution, retire any old copies.

[mcafeenewb]

The only problem with the provided HF (thank you by the way);  only problem so far is that it will not install n FIPS enabled servers.  Log file indicates FIPS is not compatible.

Any suggestions?