cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Highlighted

Re: ePO - OpenSSL versions (CVE-2014-0160)

Jump to solution

Unfortunately bouncing the box didn't resolve the issue. I agree with your statement on the risk. The potential data loss her is minimal and was looking for aquick  fix in waiting for McAfee to deliver an approved solution.

Highlighted

Re: ePO - OpenSSL versions (CVE-2014-0160)

Jump to solution

Interesting that you got those results. We replaced the .exe and dll on a few of our ePO boxes as a test, then rebooted them and rescanned with updated Nexpose (they updated the signatures for this again today) and scan clean for CVE-2014-0160.  After seeing your post I also checked our public ones against  http://filippo.io/Heartbleed/ and it also reports them as clean.

Highlighted
Level 10
Report Inappropriate Content
Message 33 of 66

Re: ePO - OpenSSL versions (CVE-2014-0160)

Jump to solution

After doing the file replacement as mentioned before, our security team scanned the server and it came back clean. Note: you must use the 32 bit version of 1.0.1g not the 64 bit version. When I tried at first with 64 bit it did not work. Had to use the 32 bit binaries.

Level 7
Report Inappropriate Content
Message 34 of 66

Re: ePO - OpenSSL versions (CVE-2014-0160)

Jump to solution

Excellent point tcox8, thanks for mentioning that. I used the 32bit versions as well.

Highlighted
Level 7
Report Inappropriate Content
Message 35 of 66

Re: ePO - OpenSSL versions (CVE-2014-0160)

Jump to solution

Running ePO 4.6.7 and confirmed OpenSSL version as 1.0.1e which is affected, but not listed on the latest SNS. I'm a bit perplexed as well.

Highlighted
Level 7
Report Inappropriate Content
Message 36 of 66

Re: ePO - OpenSSL versions (CVE-2014-0160)

Jump to solution

Unlikely to get a 'official' confirmation of the impacted status until a patch is ready. Nature of the beast

Recommend contextual risk assessment and action appropriate to your envrionment.

Highlighted
Level 11
Report Inappropriate Content
Message 37 of 66

Re: ePO - OpenSSL versions (CVE-2014-0160)

Jump to solution

Still nothing ? Well no big deal. Not like they are a security company or anything. Oh wait..

Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 38 of 66

Re: ePO - OpenSSL versions (CVE-2014-0160)

Jump to solution

Hotfixes for ePO versions are now available: please see the updated bulletin at SB10071  for details.

Regards -

Joe

Highlighted
Level 10
Report Inappropriate Content
Message 39 of 66

Re: ePO - OpenSSL versions (CVE-2014-0160)

Jump to solution

Hey everyone, I'll try to simplify the steps for you all:

  1. Download the Hotfix
  2. Backup your ePO server KB71825
    1. Make sure you follow the KB
  3. Update the ePO server KB71825
    1. Update the Agent Handler(s) if applicable
  4. Change the SQL Password, and update on ePO and AH with the new passwords.
  5. Create new agent-server communication keys KB81674
  6. Create a daily task for MA - Product Update - "ePO Agent Key Updater"
    1. Monitor, backup and retire old keys accordingly.
    2. Create new agent package for distribution, retire any old copies.

View solution in original post

Highlighted

Re: ePO - OpenSSL versions (CVE-2014-0160)

Jump to solution

The only problem with the provided HF (thank you by the way);  only problem so far is that it will not install n FIPS enabled servers.  Log file indicates FIPS is not compatible.

Any suggestions?

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community