Solved

Barracuda SSLVPN Heartbleed Vulnerability

Posted on 2014-04-11
6
488 Views
Last Modified: 2014-04-29
Does anyone have documentation that states that this device is NOT vulnerable.  Barracuda support told me it was not.  When I asked for documentation, they sent a "chat" conversation where they said it was not vulnerable.   The model number is 180.

Thanks in advance!
0
Comment
Question by:sfjcpu
  • 3
  • 2
6 Comments
 
LVL 33

Expert Comment

by:Dave Howe
Comment Utility
testing is a good idea - it might not even run openssl. here is a handy testing tool:

https://www.ssllabs.com/ssltest/

And you might want to consider installing one of the firefox or chrome plugins that give realtime display of the "heartbleed" bug whenever you visit a secure server.
0
 
LVL 12

Expert Comment

by:Carlo-Giuliani
Comment Utility
Use this popular site to test your SSLVPN appliance: http://filippo.io/Heartbleed/

I tested ours and found it was not vulnerable.  Which means Barracuda does not use OpenSSL, I suppose.
0
 
LVL 33

Accepted Solution

by:
Dave Howe earned 250 total points
Comment Utility
the ssllabs one is more comprehensive, carlo - instead of just testing for one thing, it gives you an assessment of overall security (including HeartBleed), and tells you which platform is being used (which is useful when determining the impact of the bug)
0
Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 
LVL 38

Assisted Solution

by:Rich Rumble
Rich Rumble earned 250 total points
Comment Utility
0
 
LVL 12

Expert Comment

by:Carlo-Giuliani
Comment Utility
I did run the SSLLABs on our Barracuda SSLVPN as well.  That was also negative.
0
 
LVL 33

Expert Comment

by:Dave Howe
Comment Utility
did it specify which engine responded, carlo?
a lot of ssl vpn engines use tomcat (aka coyote) which uses java crypto libraries, not openssl.
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Envision that you are chipping away at another e-business site with a team of pundit developers and designers. Everything seems, by all accounts, to be going easily.
Today, still in the boom of Apple, PC's and products, nearly 50% of the computer users use Windows as graphical operating systems. If you are among those users who love windows, but are grappling to keep the system's hard drive optimized, then you s…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…
This tutorial demonstrates a quick way of adding group price to multiple Magento products.

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now