topic Re: What Netapp Products are subject to OpenSSL Heartbleed Vulnerability in Network and Storage Protocols

What Netapp Products are subject to OpenSSL Heartbleed Vulnerability

gregory_a_price — Thu, 05 Jun 2025 05:38:32 GMT

There was a major vulnerability disclosed in OpenSSL yesterday which is being referred to as heartbleed. While the specifics are still being investigated, it places all userid/passwords at risk when using OpenSSL. I know that some Netapp products use it and am trying to find out which are vulnerable and what the plans are for addressing it.

Re: What Netapp Products are subject to OpenSSL Heartbleed Vulnerability

FULLSTEAM — Wed, 09 Apr 2014 19:23:02 GMT

OnCommand Core 5.2P2 is vulnerable. Already case'd it.

Re: What Netapp Products are subject to OpenSSL Heartbleed Vulnerability

ajosh — Thu, 10 Apr 2014 00:33:26 GMT

NetApp takes the security of our products very seriously and is committed to resolving vulnerabilities to meet the needs of our customers and the broader technology community.

If there is a security issue with a third-party software component that is used in a NetApp product, NetApp will attempt to verify the vulnerability and will prioritize it based on the relative severity of the vulnerability as well as the business needs of the organization.

NetApp is currently evaluating the impact of the OpenSSL vulnerability. We will provide an update as additional information becomes available.

Re: What Netapp Products are subject to OpenSSL Heartbleed Vulnerability

FULLSTEAM — Thu, 10 Apr 2014 00:42:27 GMT

A decidedly vague and unhelpful PR dodge.

Please take a clue from many other vendors (e.g http://kb.vmware.com/kb/2076225😞 Share what you know, as you know it, in a public spot, even if it's not much.

That it's been this long with technical radio silence and trade show song-and-dance on the social media feeds is insanity.

Re: What Netapp Products are subject to OpenSSL Heartbleed Vulnerability

JONATHAPQ — Thu, 10 Apr 2014 08:51:09 GMT

I have a case open with Netapp currently for this and bugs 815987 & 816639 have been opened for investigation/handling of the vulnerability CVE-2014-0160:

http://support.netapp.com/NOW/cgi-bin/bol?Type=Detail&Display=815987 - no public-facing notes as yet but looks like no version of ONTAP ships with OpenSSL 1.0.1x, so ONTAP is unaffected.

http://support.netapp.com/NOW/cgi-bin/bol?Type=Detail&Display=816639 - this is a newly filed bug so may not have hit 24 hour mark yet until later today.

Re: What Netapp Products are subject to OpenSSL Heartbleed Vulnerability

gregory_a_price — Thu, 10 Apr 2014 20:31:56 GMT

It appears that the SMI-S client is also vulnerable.

Re: What Netapp Products are subject to OpenSSL Heartbleed Vulnerability

ajosh — Thu, 10 Apr 2014 23:28:16 GMT

We have posted our current status for CVE-2014-0160 at the following URL:

https://library.netapp.com/ecm/ecm_get_file/ECMP1516404

We will continue to be making updates as new information is available.

Re: What Netapp Products are subject to OpenSSL Heartbleed Vulnerability

FULLSTEAM — Fri, 11 Apr 2014 00:14:59 GMT

Will that link be THE place for ongoing updates?

Re: What Netapp Products are subject to OpenSSL Heartbleed Vulnerability

ajosh — Fri, 11 Apr 2014 16:55:32 GMT

Yes, this link will remain static and be the location for official communications regarding CVE-2014-0160.

Re: What Netapp Products are subject to OpenSSL Heartbleed Vulnerability

JLOCKIE_CEFCU — Thu, 17 Apr 2014 17:36:49 GMT

So now I have to monitor some static PDF page to find when a patch is released? Meanwhile, we are going to get completely nailed by regulatory audits since Nessus has a plug-in to detect this.....please NetApp PATCH THIS.

Re: What Netapp Products are subject to OpenSSL Heartbleed Vulnerability

JLOCKIE_CEFCU — Tue, 22 Apr 2014 17:06:37 GMT

This document isn't even current! There's a patch for OnCommand Unified Manager Core, but the PDF still lists it as vulnerable.

Again, this is a very poor communication.

Re: What Netapp Products are subject to OpenSSL Heartbleed Vulnerability

ajosh — Tue, 22 Apr 2014 17:12:41 GMT

The document is being updated almost daily. Please reference the section entitled "Software Versions and Fixes" for patch information. The list of Vulnerable products does not change as patches are released.

Re: What Netapp Products are subject to OpenSSL Heartbleed Vulnerability

JLOCKIE_CEFCU — Tue, 22 Apr 2014 17:16:34 GMT

I suggest you add an executive summary then, or at the very least put a note to the right of the vulnerable products stating "patched - see below".....NetApp has way too many products to expect customers who are only using a handful of them to skim a huge list (on a PDF none the less).

Re: What Netapp Products are subject to OpenSSL Heartbleed Vulnerability

JONATHAPQ — Wed, 23 Apr 2014 08:31:26 GMT

ctrl+f ?

Re: What Netapp Products are subject to OpenSSL Heartbleed Vulnerability

bazmercer — Wed, 23 Apr 2014 12:33:17 GMT

Hi,

The changelog for oncommand core 5.2r1 indicates it's added support for "OpenSSL 1.0.1e" - which is still vulnerable.

Re: What Netapp Products are subject to OpenSSL Heartbleed Vulnerability

bazmercer — Wed, 23 Apr 2014 14:16:26 GMT

well, the updated version was still running 1.0.1e (although it may well have been compiled differently). As I can't tell, I've replaced it with 1.0.1g and it seems ok. This is probably unsupported so do so at your own risk etc etc.

Re: What Netapp Products are subject to OpenSSL Heartbleed Vulnerability

FULLSTEAM — Wed, 23 Apr 2014 14:55:29 GMT

RHAT's patch for openssl was a backport into 1.0.1e; could be what they did here. Eh, whatever, 5.2R1 scanned cleanly as-deployed without jimmying it.

Though, what you did (symlinking/copying a known-good lib over OC's static library) was our last-ditch plan if the patch was going to take too long.

Re: What Netapp Products are subject to OpenSSL Heartbleed Vulnerability

JLOCKIE_CEFCU — Wed, 23 Apr 2014 15:06:49 GMT

I can also confirm it scans clean after patching. No need to mess with it. It was lighting up like a Christmas tree on previous scans.

Would be nice if they used Apache 2.4.6 instead of 2.4.4 due to CVE-2013-2249.

Re: What Netapp Products are subject to OpenSSL Heartbleed Vulnerability

bazmercer — Wed, 23 Apr 2014 15:12:46 GMT

Ah ok fair enough. I didn't have any scan tools so was just playing it safe. Thanks for the info.

Re: What Netapp Products are subject to OpenSSL Heartbleed Vulnerability

FULLSTEAM — Wed, 23 Apr 2014 15:16:04 GMT

http://gobuild.io/download/github.com/titanous/heartbleeder