SB-CS-1406: ETERNUS CS8000 SERIES - V5.1 / V6.0 HEARTBLEED INFORMATION
PROBLEM / QUESTION
As you may already know from the news, there was found a critical defect in versions 1.0.1 and 1.0.2 beta1 of OpenSSL, the cryptographic software library, known as the "Heartbleed bug". This bulletin will inform you about the consequences for ETERNUS CS8000 products.
Within ETERNUS CS8000 V5.1 and V6.0 only the ServerView RAID Manager is affected.
SOLUTION / CROSSING SOLUTION
Updated versions of ETERNUS CS8000 V6.0 are available (SP02).
Updated versions of ETERNUS CS8000 V5.1 are available (SP03 P05).
Please update to the latest version.
Since Version V5.1 the port in the ETERNUX CS Firewall for ServerView RAID webgui is switched off by default, therefore access is only possible from inside ETERNUS CS8000.
The ServerView RAID port number in question is 3173 and you can check port setting by the cli command “iptables”. The command “iptables -vL” shows all the rules, but it uses symbolic names instead of the port numbers. The mapping between port numbers and symbolic names can be found in /etc/services. All ports that are not listed in the iptables output are blocked by the firewall.
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. THIS DOCUMENT IS SUBJECT TO CHANGE OR UPDATE AT ANY TIME. FUJITSU EXPECTS TO UPDATE THIS DOCUMENT AS NEW INFORMATION BECOMES AVAILABLE.
Last Update: 17.04.2014