OpenSSL Alternative Chains Certificate Forgery ...

1 cisco Security AdvisoryOpenSSL Alternative Chains Certificate Forgery vulnerability (July 2015) Affecting CiscoProductsAdvisory ID: cisco -sa-20150710-opensslLast Updated:2015 September 16 16:54 GMTP ublished:2015 July 10 16:00 :FinalWorkarounds:See belowCVE-2015-1793 Download CVRFD ownload PDFE mailSummaryOn July 9, 2015, the OpenSSL Project released a security advisory detailing a vulnerability affecting applications that verifycertificates, including SSL/Transport Layer Security (TLS)/Datagram Transport Layer Security (DTLS) clients and SSL/TLS/DTLS servers using client cisco products incorporate a version of the OpenSSL package affected by this vulnerability that could allow anunauthenticated, remote attacker to cause certain checks on untrusted certificates to be bypassed, enabling the attacker to forge"trusted" certificates that could be used to conduct man-in-the-middle advisory will be updated as additional information becomes will release free software updates that address this that mitigate this vulnerability may be advisory is available at the following link.

2 ProductsThe bugs are accessible through the and will contain additional platform-specific information, includingCisco Bug Search Toolworkarounds (if available) and fixed software ProductsThe following cisco products have been confirmed to be impacted by one or more of the vulnerabilities contained in the July 10,2015, OpenSSL Project security advisory:ProductDefectFixed releases availabilityCollaboration and Social MediaCisco (1-May-2016) cisco WebEx Node for MCSCSCuv26109 Endpoint Clients and Client SoftwareCisco Agent for OpenFlowCSCuv26243 Patch file available for affected Jabber Software Development (0) (26-Aug-2015)Network and Content Security DevicesCisco ASA CX and cisco Prime Security (MR6) (Sep 2015) cisco Virtual Security Gateway for Microsoft (1)VSG2( ) (31-Oct-2015)Network Management and ProvisioningCisco Packet (18-Dec-2015) cisco Prime Access (Oct 2015) (Oct 2015) cisco Prime Collaboration (Mar 2016) cisco Prime Collaboration (31-Jul-2015) (31-Jul-2015) (31-Jul-2015) (31-Jul-2015) cisco Prime License (Oct 2015) (Dec 2015) cisco Prime Network Services (20-Aug-2015)

3 cisco Prime Security (29-Aug-2015) cisco Security SP1 (31-Jul-2015) (31-Aug-2015)Local Collector Appliance (LCA) (7-Aug-2015)Routing and Switching - Enterprise and Service ProviderCisco 910 Industrial (20-Aug-2015) cisco IOS-XE (WebUI feature only) (Available) (Next Release) cisco Nexus 9000 (ACI/Fabric Switch) (Aug 2015)Unified ComputingCisco Virtual Security (1)VSG2( ) (30-Dec-2015)Voice and Unified Communications DevicesCisco Emergency (Feb 2016) cisco IM and Presence Service (CUPS)CSCuv26296 cisco (20-Oct-2015) (20-Oct-2015) (20-Oct-2015) cisco Unified Attendant Console (2) (30-Sept-2015)Video, Streaming, TelePresence, and Transcoding DevicesCisco Digital Media Players (DMP) 4300 (1)RB(2P4) (6)RB(2P3) cisco Digital Media Players (DMP) 4400 (1)RB(2P4) (6)RB(2P3) cisco Digital Media (1)RB(2P4) (6)RB(2P3) cisco Model D9485 DAVIC (31-Jul-2015) cisco TelePresence (29-Jul-2015) cisco Videoscape Control SuiteCSCuv33644 Patch file available for affected releases(20-Jul-2015) cisco Hosted ServicesCisco Registered Envelope Service (CRES) (1-Aug-2015) cisco Universal Small Cell 5000 Series running Universal Small Cell 7000 Series running WebEx Messenger EP1 (Available)Network Performance Analytics (NPA) (30-Sept-2015)Partner Supporting Service (PSS) Analytic PlatformCSCuv26091 Patch file available for affected Confirmed Not VulnerableCisco has confirmed that the following products are not vulnerable to the vulnerability announced by the OpenSSLP roject on July 9, 2015.

4 Collaboration and Social MediaCisco WebEx Meetings Server versions WebEx Meetings Server versions Security VulnerabilityPolicyTo learn about cisco securityvulnerability disclosure policiesand publications, see the .Security vulnerability PolicyThis document also containsinstructions for obtaining fixedsoftware and receiving securityvulnerability information ResourcesOpenSSL AlternativeChains Certificate ForgeryBypass Vulnerability3511135307 Subscribe to cisco SecurityNotificationsSubscribeEndpoint Clients and Client SoftwareCisco AnyConnect Secure Mobility Client for AndroidCisco AnyConnect Secure Mobility Client for LinuxCisco AnyConnect Secure Mobility Client for WindowsCisco AnyConnect Secure Mobility Client for iOSCisco IP CommunicatorCisco Jabber Guest (2)

5 cisco Jabber for AndroidCisco Jabber for MacCisco Jabber for WindowsCisco Jabber for iOSCisco NAC Agent for MacCisco NAC Agent for WebCisco NAC Agent for WindowsCisco UC Integration for Microsoft LyncCisco Unified Personal CommunicatorCisco WebEx Meetings Client - HostedCisco WebEx Meetings Client - On PremisesCisco WebEx Meetings for AndroidCisco WebEx Meetings for BlackberryCisco WebEx Productivity ToolsWebEx Meetings Server - SSL GatewayWebEx Recording Playback ClientNetwork Application, Service, and AccelerationCisco ACE 30 Application Control Engine ModuleCisco ACE 4710 Application Control Engine (A5) cisco ACE GSS 4400 Series Global Site SelectorCisco Application and Content Networking System (ACNS) cisco Extensible Network Controller (XNC) cisco InTracerCisco Network Admission Control (NAC) cisco Nexus Data Broker (NDB) cisco Visual Quality Experience ServerCisco Visual Quality Experience Tools ServerCisco Wide Area Application Services (WAAS)Network and Content Security DevicesCisco ASA Content Security and Control (CSC) Security Services ModuleCisco Adaptive Security Appliance (ASA) cisco Adaptive Security Device ManagerCisco Clean Access ManagerCisco Content Security Appliance Updater ServersCisco Content Security Management Appliance (SMA) cisco Email Security Appliance (ESA) cisco FireSIGHT System SoftwareCisco IPSC isco Identity Services Engine (ISE) cisco IronPort Encryption Appliance (IEA)

6 cisco NAC Guest ServerCisco NAC ServerCisco Physical Access Control GatewayCisco Physical Access ManagerCisco Secure Access Control Server (ACS) cisco Web Security Appliance (WSA)Network Management and ProvisioningCisco Application Networking ManagerCisco Cloupia Unified Infrastructure ControllerCisco Configuration ProfessionalCisco Connected Grid Device ManagerCisco Connected Grid Network Management SystemCisco Digital Media ManagerCisco Insight ReporterCisco Linear Stream ManagerCisco MGC Node Manager (CMNM) cisco Multicast ManagerCisco Netflow Collection AgentCisco Network Analysis ModuleCisco Prime AnalyticsCisco Prime Cable ProvisioningCisco Prime Central for SPsCisco Prime Collaboration AssuranceCisco Prime Collaboration ManagerCisco Prime Data Center Network Manager (DCNM) cisco Prime HomeCisco Prime IP ExpressCisco Prime Infrastructure Standalone Plug and Play GatewayCisco Prime InfrastructureCisco Prime LAN Management Solution (LMS - Solaris) cisco Prime Network Registrar (CPNR) cisco Prime NetworkCisco Prime Optical for SPsCisco Prime Performance ManagerCisco Prime Provisioning for SPsCisco Prime ProvisioningCisco Show and Share (SnS) cisco UCS CentralCisco Unified Intelligence CenterCisco Unified Provisioning Manager (CUPM)

7 CiscoWorks Network Compliance ManagerRouting and Switching - Enterprise and Service ProviderCisco ASR 5000 SeriesCisco Application Policy Infrastructure Controller (APIC) cisco Broadband Access Center Telco WirelessCisco Connected Grid Router - CGOSC isco IOS Software and cisco IOS-XE SoftwareCisco IOS-XE (SSLVPN feature) cisco IOS-XRCisco MDS 9000 Series Multilayer SwitchesCisco Mobile Wireless Transport ManagerCisco Nexus 1000V InterCloudCisco Nexus 1000V Series SwitchesCisco Nexus 2000 Series FEXC isco Nexus 3X00 Series SwitchesCisco Nexus 4000 Series Blade SwitchesCisco Nexus 5000 Series SwitchesCisco Nexus 6000 Series SwitchesCisco Nexus 7000 Series SwitchesCisco Nexus 9000 Series (standalone, running NxOS) cisco ONS 15454 Series Multiservice Provisioning PlatformsCisco OnePK All-in-One VMCisco Service Control Operating SystemRouting and Switching - Small BusinessCisco Sx220 switchesCisco Sx300 switchesCisco Sx500 switchesUnified ComputingCisco Common Services Platform CollectorCisco Standalone rack server CIMCC isco UCS Invicta Series Solid State SystemsCisco Unified Computing System (Management software) cisco Unified Computing System B-Series (Blade)

8 ServersCisco Virtualization Experience Media EngineVoice and Unified Communications DevicesCisco 190 ATA Series Analog Terminal AdaptorCisco 8800 Series IP Phones - VPN FeatureCisco ATA 187 Analog Telephone AdaptorCisco Agent Desktop for cisco Unified Contact Center ExpressCisco Agent DesktopCisco Billing and Measurements ServerCisco Computer Telephony Integration Object Server (CTIOS) cisco DX Series IP PhonesCisco FinesseCisco Hosted Collaboration Mediation FulfillmentCisco IP Interoperability and Collaboration System (IPICS) cisco MeetingPlaceCisco Packaged Contact Center EnterpriseCisco Paging Server (Informacast) cisco Paging ServerCisco Remote Silent MonitoringCisco SPA112 2-Port Phone AdapterCisco SPA122 ATA with RouterCisco SPA232D Multi-Line DECT ATAC isco SPA30X Series IP PhonesCisco SPA50X Series IP PhonesCisco SPA51X Series IP PhonesCisco SPA525 GCisco SPA8000 8-port IP Telephony GatewayCisco SPA8800 IP Telephony Gateway with 4 FXS and 4 FXO PortsCisco TAPI Service Provider (TSP)

9 cisco USC8088 cisco Unified 3900 series IP PhonesCisco Unified 6901 IP PhonesCisco Unified 6911 IP PhonesCisco Unified 6921 IP PhonesCisco Unified 6945 IP PhonesCisco Unified 7800 Series IP PhonesCisco Unified 8831 series IP Conference PhoneCisco Unified 8945 IP PhoneCisco Unified 8961 IP PhoneCisco Unified 9951 IP PhoneCisco Unified 9971 IP PhoneCisco Unified Attendant Console AdvancedCisco Unified Attendant Console Business EditionCisco Unified Attendant Console Department EditionCisco Unified Attendant Console Enterprise EditionCisco Unified Attendant Console Premium EditionCisco Unified Client Services FrameworkCisco Unified Communications Domain ManagerCisco Unified Communications Manager (UCM) cisco Unified Communications Manager Session Management Edition (SME) cisco Unified Contact Center EnterpriseCisco Unified Contact Center ExpressCisco Unified E-Mail Interaction ManagerCisco Unified IP Conference Phone 8831 for Third-Party Call ControlCisco Unified IP Phone 7900 SeriesCisco Unified Integration for IBM SametimeCisco Unified Intelligent Contact Management EnterpriseCisco Unified Operations Manager (CUOM) cisco Unified Sip ProxyCisco Unified Web Interaction ManagerCisco Unified Workforce OptimizationCisco Unity Connection (UC) cisco Unity ConnectionCisco Virtual PGW 2200 SoftswitchCisco Voice Portal (CVP)xony VIM/CCDM/CCMPV ideo, Streaming, TelePresence, and Transcoding DevicesCisco AnyRes Live (CAL) cisco AnyRes VOD (CAL)

10 cisco D9824 Advanced Multi Decryption ReceiverCisco D9854/D9854-I Advanced Program ReceiverCisco D9858 Advanced receiver TranscoderCisco D9859 Advanced receiver TranscoderCisco d9865 satellite ReceiverCisco DCM Series 9900-Digital Content ManagerCisco Edge 300 Digital Media PlayerCisco Edge 340 Digital Media PlayerCisco Enterprise Content Delivery System (ECDS) cisco Expressway SeriesCisco Headend System ReleaseCisco Internet Streamer (CDS) cisco Jabber Video for TelePresence (Movi) cisco Media Experience Engines (MXE) cisco Media Services InterfaceCisco TelePresence 1310 cisco TelePresence Advanced Media Gateway SeriesCisco TelePresence Content Server (TCS) cisco TelePresence EX SeriesCisco TelePresence Exchange System ()