What is it?
On June 5th, 2014 OpenSSL released a fix for seven security vulnerabilities, including a serious flaw (CVE-2014-0224) that enables man-in-the-middle (MITM) attacks, potentially allowing the attacker to decrypt and modify traffic from the attacked client and server if BOTH are vulnerable. It is not a general attack on a web server. The problem is that OpenSSL accepts ChangeCipherSpec (CCS) inappropriately during a handshake.
As of March of 2014, about two thirds of all webservers use OpenSSL as part of their stack, making any vulnerability in it of critical importance.
What can you do to protect your company?
Most of our customers protected their infrastructure against the Heartbleed vulnerability last month, and those same protections apply to this case.
Imperva and Incapsula both provide mitigation for applications protected by our WAFs as follows:
- SecureSphere customers that deployed their WAFs in Kernel Reverse Proxy (KRP) mode are automatically protected because SecureSphere controls the SSL connection. If not, customers can configure SecureSphere WAF to protect against this vulnerability
- Incapsula customers are protected: see how
- Neither? Sign up for Incapsula now using the free trial to close the gap while you evaluate your options.
If none of these are an option, patching to the latest and greatest OpenSSL software (version 1.0.1h or newer) resolves the vulnerability at the software infrastructure level, and is a best practice.
Was Imperva impacted?
Some of our products and services were vulnerable to the bug prior to our recent patches. We don’t believe any were impacted by exploits. You can read the details in our security advisory. Similarly, Incapsula was able to quickly patch its entire network in record time.
Is this a big deal?
We think that this particular vulnerability is less relevant than Heartbleed for two reasons. First, Heartbleed allowed all impacted organizations to test their patching and vulnerability response processes, and within a month of Heartbleed nobody has had a chance to forget them. Secondly, this discovery is a consequence of the increased scrutiny that OpenSSL is receiving. As an outcome of code review, this vulnerability appeared without a publicized exploit. At the time of this posting we have not found a working exploit for it.
What next?
In the wake of Heartbleed, members of the OpenBSD project forked OpenSSL starting with the 1.0.1g branch, to create a project named LibreSSL. In the first week of pruning the OpenSSL’s codebase, more than 90,000 lines of C code had been removed from the fork. We at Imperva strongly believe that code should be thoroughly reviewed and tested, but that is never sufficient to provide the right level of security in the face of today’s modern threats and attacks.
Try Imperva for Free
Protect your business for 30 days on Imperva.
