OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols, as well as a full-strength, general purpose cryptography library.
An information disclosure flaw was found in the way OpenSSL handled TLS and DTLS Heartbeat Extension packets. A malicious TLS or DTLS client or server could send a specially crafted TLS or DTLS Heartbeat packet to disclose a limited portion of memory per request from a connected client or server. Note that the disclosed portions of memory could potentially include sensitive information such as private keys. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2014-0160 to this issue. Redhat Enterprise Linux specific information may be found in the Redhat CVE Database.
This issue did not affect the versions of openssl as shipped with Red Hat Enterprise Linux 5, and Red Hat Enterprise Linux 6.4 and earlier.
More information about this vulnerability can be found in the security advisories at:
Information about this vulnerability concerning the Avaya VPN Gateway can be found at:
Information about this vulnerability concerning the Avaya Wireless LAN (WLAN) product can be found at:
Information about this vulnerability concerning the Avaya Ethernet Switching products can be found at:
Information about this vulnerability concerning Avaya Identity Engines can be found at:
Information about this vulnerability concerning Avaya Services Support products can be found at:
Information about this vulnerability concerning Avaya Scopia products can be found at:
More information about this vulnerability for Emerging Products and Technology solutions can be found in the security advisory at:
| Product: | Version(s): | Risk Level: | Actions: |
|---|---|---|---|
| Avaya CMS | R17.x | None | See Mitigating Factors table below. |
| Avaya Aura® Collaboration Environment | 2.x | None | See Mitigating Factors table below. |
| Avaya Aura® Experience Portal | 6.x, 7.x | None | See Mitigating Factors table below. |
| Avaya IP Office Server Edition | 8.1, 9.x | None | See Mitigating Factors table below. |
| Avaya IP Office Application Server | 9.x | None | See Mitigating Factors table below. |
| Avaya one-X® Client Enablement Services | 6.2.x | None | See Mitigating Factors table below. |
| Avaya Aura® Session Manager | 6.3.x | None | See Mitigating Factors table below. |
| Avaya Virtual Application Manager | 6.2.x | None | See Mitigating Factors table below. |
| Product: | Version(s): | Risk Level: | Actions: |
|---|---|---|---|
| Avaya Aura® Application Enablement Services | 5.x, 6.x | None | See Mitigating Factors table below. |
Avaya Aura® Application Server 5300:
|
2.x, 3.x | None | See Mitigating Factors table below. |
| Avaya Aura® Communication Manager: | 5.2.x, 6.x | None | See Mitigating Factors table below. |
| Avaya Aura® Communication Manager Messaging: | 5.2.x, 6.x | None | See Mitigating Factors table below. |
| Avaya IQ | 5.x | None | See Mitigating Factors table below |
Avaya Communication Server 1000:
|
6.x, 7.x | None | See Mitigating Factors table below. |
| Avaya Aura® Conferencing | 7.x | None | See Mitigating Factors table below. |
| Avaya Aura® Conferencing Standard Edition | 6.x | None | See Mitigating Factors table below. |
| Avaya IP Office Application Server | 8.x | None | See Mitigating Factors table below. |
| Avaya Meeting Exchange | 6.x | None | See Mitigating Factors table below. |
| Avaya Aura® Messaging | 6.x | None | See Mitigating Factors table below. |
| Avaya one-X® Client Enablement Services | 6.1.x | None | See Mitigating Factors table below. |
| Avaya Aura® Presence Services | 6.x | None | See Mitigating Factors table below. |
| Avaya Proactive Contact | 4.x, 5.x | None | See Mitigating Factors table below. |
| Avaya Aura® Session Manager | 5.2 thru 6.2.3 | None | See Mitigating Factors table below. |
| Avaya Aura® SIP Enablement Services | 5.2.x | None | See Mitigating Factors table below. |
| Avaya Aura® System Manager | 5.2 thru 6.x | None | See Mitigating Factors table below. |
| Avaya Aura® System Platform | 1.x, 6.x | None | See Mitigating Factors table below. |
| Avaya Aura® Communication Manager Utility Services | 6.x | None | See Mitigating Factors table below. |
| Avaya Voice Portal | 5.x | None | See Mitigating Factors table below. |
| Product: | Version(s): | Risk Level: | Actions: |
|---|---|---|---|
| Avaya 96x1 IP Deskphones | 6.x | None | See Mitigating Factors table below. |
| Avaya B189 Conference Phone | 1.x | None | See Mitigating Factors table below. |
| Product: | Version(s): | Risk Level: | Actions: |
|---|---|---|---|
| Avaya Client Applications Collaboration Services | All | None | See Mitigating Factors table below. |
| Avaya Client Applications for Microsoft Lync Integration | All | None | See Mitigating Factors table below. |
| Avaya Communicator for Android | 2.x | High | Install the latest version available from the Google Play Store. Users with automatic updates turned on (the default) will receive the fix automatically. |
| Avaya Flare Experience for Windows | All | None | See Mitigating Factors table below. |
| Avaya Flare Experience for iPad | All | None | See Mitigating Factors table below. |
| Avaya VDI Communicator | All | None | See Mitigating Factors table below. |
| Avaya one-X Communicator for Mac OS X | All | None | See Mitigating Factors table below. |
| Avaya one-X Communicator for Windows | All | None | See Mitigating Factors table below. |
| Avaya one-X Mobile CES for iOS | All | None | See Mitigating Factors table below. |
| Avaya one-X Mobile Lite for Android | All | None | See Mitigating Factors table below. |
| Avaya one-X Mobile Lite for iOS | All | None | See Mitigating Factors table below. |
| Avaya one-X Mobile SIP for iOS | All | None | See Mitigating Factors table below. |
| Avaya one-X Mobile for Blackberry | All | None | See Mitigating Factors table below. |
| Avaya one-X Attendant | All | None | See Mitigating Factors table below. |
| Avaya C3000 Unified Messaging | All | None | See Mitigating Factors table below. |
| Product: | Version(s): | Risk Level: | Actions: |
|---|---|---|---|
Avaya Media Processing Server:
|
3.x, 4.1 | None | See Mitigating Factors table below. |
| Avaya Media Processing Server on Windows: |
4.1 | High | Install patch dist4.1.0.11. Until such time as the patch can be installed disable the OpenSSH service and do not use ssh utilities. |
| Product: | Version(s): | Risk Level: | Actions: |
|---|---|---|---|
| Avaya 1600 Series IP Deskphones | All | None | See Mitigating Factors table below. |
| Avaya 96x0 H323 IP Deskphones | 3.2.1 and earlier | None | See Mitigating Factors table below. |
| Avaya 96x0 H323 IP Deskphones | 3.2.2 | None | See Mitigating Factors table below. |
| Avaya 96x0 SIP IP Deskphones | 2.6.11 and earlier | None | See Mitigating Factors table below. |
| Avaya G250/G350/G4xx/G6xx/G700 Gateways | All | None | See Mitigating Factors table below. |
| Product: | Version(s): | Risk Level: | Actions: |
|---|---|---|---|
| Avaya Session Border Controller for Enterprise | 4.x, 6.2.x | None | See Mitigating Factors table below. |
| Avaya Aura® Session Border Controller | 6.x | None | See Mitigating Factors table below. |
| Product: | Version(s): | Risk Level: | Actions: |
|---|---|---|---|
| Avaya CMS | R16.x, R17 | None | See Mitigating Factors table below. |
| Avaya Interactive Response | 3.0, 4.0 | None | See Mitigating Factors table below. |
| Product: | Version(s): | Risk Level: | Actions: |
|---|---|---|---|
| Avaya B179 Conference Phone | All | None | See Mitigating Factors table below. |
| Avaya AVK3 | All | None | See Mitigating Factors table below. |
| Integral I5 | All | None | See Mitigating Factors table below. |
| Integral Enterprise (IE) | All | None | See Mitigating Factors table below. |
| Product: | Version(s): | Risk Level: | Actions: |
|---|---|---|---|
| Avaya 1100/1200 SIP Phone | 4.4 | None | See Mitigating Factors table below. |
| Avaya 1100/1200 UniSTIM Phone | 5.5 PF1 | None | See Mitigating Factors table below. |
| Avaya Destop Video Device | All | None | See Mitigating Factors table below. |
| Avaya E129 IP Deskphone | All | None | See Mitigating Factors table below. |
| Product: | Version(s): | Risk Level: | Actions: |
|---|---|---|---|
| Avaya Aura® Contact Center (SIP - CM) | 6.3 and earlier | None | See Mitigating Factors table below. |
| Avaya Aura® Contact Center (SIP - CM) | 6.4 | High | Install 6.4 Service Pack 12 or later. |
| Avaya Aura® Contact Center (Mid Market - AACC) (SIP - CM) | All | High | Install 6.4 Service Pack 12 or later. |
| Avaya Aura® Contact Center (AML - CS1K) | All | None | See Mitigating Factors table below. |
| Avaya Aura® Work Force Optimization | 10.1, 11.0 | High | Install the latest available hot fix. |
| Avaya Aura® Work Force Optimization | 12.x | None | See Mitigating Factors table below. |
| Avaya Speech Analytics | All | None | See Mitigating Factors table below. |
| Product: | Version(s): | Risk Level: | Actions: |
|---|---|---|---|
| Avaya Aura® Communication Manager | 4.0 thru 5.1.x | None | See Mitigating Factors table below. |
| Avaya Meeting Exchange | 5.x | None | See Mitigating Factors table below. |
| Avaya Message Networking | 5.x | None | See Mitigating Factors table below. |
| Avaya Message Storage Server | 5.x | None | See Mitigating Factors table below. |
| Avaya Aura® SIP Enablement Services | 4.0 thru 5.1.x | None | See Mitigating Factors table below. |
| Product: | Version(s): | Risk Level: | Actions: |
|---|---|---|---|
| Avaya CallPilot® | All | None | See Mitigating Factors table below. |
| Avaya Messaging Application Server | All | None | See Mitigating Factors table below. | Avaya Elite Multichannel | All | None | See Mitigating Factors table below. |
Recommended Actions for System Products:
Avaya strongly recommends following the
networking and security best practices by implementing
firewalls, ACLs, physical security or other appropriate
access restrictions. Though Avaya believes such
restrictions should always be in place, risk to Avaya
products and the surrounding network from this potential
vulnerability may be mitigated by ensuring these
practices are implemented until such time as an Avaya provided
product update or the recommended Avaya action is applied.
Further restrictions as deemed necessary based on the
customer's security policies may be required during this
interim period, but the System Product operating system or
application should not be modified unless the change is
approved by Avaya.
Making changes that are not approved may void the Avaya product service contract.
When determining risk, Avaya takes into account many factors as outlined by Avaya's Security Vulnerability Classification Policy. The following table describes factors that mitigate the risk of specific vulnerabilities for affected Avaya products:
| Vulnerability | Mitigating Factors |
|---|---|
|
CVE-2014-0160 |
This is a High risk for Avaya Communicator for Android and Scopia 8.3.0.61 due to the potential for exposure of sensitive information or Denial of Service (DoS). There is no risk for the 96x0 H323 version 3.2.2 IP Deskpone because the heartbeat functionality is not enabled. This is a High risk for AACC 6.4 as the AMS 7.6 component, whether deployed co-resident or standalone on Windows or Linux, is potentially vulnerable to the exposure of sensitive information. This is a High risk for WFO 10.1 and 11.0 due to the potential for exposure of sensitive information. There is no risk for Avaya Virtual Application Manager because the heartbeat functionality is not enabled. There is no risk for all other listed products as the affected openssl versions are not installed. |
Avaya software-only products operate on general-purpose operating systems. Occasionally vulnerabilities may be discovered in the underlying operating system or applications that come with the operating system. These vulnerabilities often do not impact the software-only product directly but may threaten the integrity of the underlying platform.
In the case of this advisory Avaya software-only products are not affected by the vulnerability directly but the underlying Linux platform may be. Customers should determine on which Linux operating system the product was installed and then follow that vendor's guidance.
| Product: | Actions: |
|---|---|
| Avaya Aura® Application Enablement Services | Depending on the Operating System installed, the affected package may be installed on the underlying Operating System supporting the AES application. |
| CVLAN | Depending on the Operating System installed, the affected package may be installed on the underlying Operating System supporting the CVLAN application. |
| Avaya Aura® Experience Portal | Depending on the Operating System installed, the affected package may be installed on the underlying Operating System supporting the EP application. |
| Avaya Integrated Management Suite (IMS) | Depending on the Operating System installed, the affected package may be installed on the underlying Operating System supporting the IMS application. |
| Avaya Aura® Presence Services | Depending on the Operating System installed, the affected package may be installed on the underlying Operating System supporting the PS application. |
| Avaya Secure Access Link Gateway | Depending on the Operating System installed, the affected package may be installed on the underlying Operating System supporting the SAL Gateway application. |
| Avaya Voice Portal | Depending on the Operating System installed, the affected package may be installed on the underlying Operating System supporting the VP application. |
Recommended Actions for Software-Only Products using Linux:
In the event that the affected package is installed, Avaya recommends following recommended actions supplied by Red Hat regarding their Enterprise Linux.
Avaya software-only products operate on general-purpose operating systems. Occasionally vulnerabilities may be discovered in the underlying operating system or applications that come with the operating system. These vulnerabilities often do not impact the software-only product directly but may threaten the integrity of the underlying platform.
In the case of this advisory Avaya software-only products are not affected by the vulnerability directly but the underlying Windows platform may be. Customers should determine on which Windows operating system the product was installed and then follow the vendor's guidance.
| Product: | Version(s): | Risk Level: | Actions: |
|---|---|---|---|
| Avaya Easy Management | All | None | See Mitigating Factors table below. |
| Avaya Central Data Management | All | None | See Mitigating Factors table below. |
| Avaya Fault and Performance Management | All | None | See Mitigating Factors table below. |
| Avaya IDSWin Accounting | All | None | See Mitigating Factors table below. |
| Avaya VOIP Manager | All | None | See Mitigating Factors table below. |
| Avaya C3000 Unified Messaging | All | None | See Mitigating Factors table below. |
| Avaya Front Office Integration System | All | None | See Mitigating Factors table below. |
| Avaya Internet Access Manager | All | None | See Mitigating Factors table below. |
| Avaya Medial Server | All | None | See Mitigating Factors table below. |
| Avaya DialIt | All | None | See Mitigating Factors table below. |
| Avaya CTI Software conneCTIon | All | None | See Mitigating Factors table below. |
| Avaya MACS Alarmserver | All | None | See Mitigating Factors table below. |
| Avaya PUMA | All | None | See Mitigating Factors table below. |
| Avaya Customer Interaction Express (CIE) | 3.1 | Low | Upgrade to 3.2.3 or later. |
| Avaya HotCom Sihot | All | None | See Mitigating Factors table below. |
| Avaya CTI Q-Server TAPI | All | None | See Mitigating Factors table below. |
| Avaya HotCom FOIS | All | None | See Mitigating Factors table below. |
Mitigating Factors for Software-Only Products using Windows:
When determining risk, Avaya takes into account many factors as outlined by Avaya's Security Vulnerability Classification Policy. The following table describes factors that mitigate the risk of specific vulnerabilities for affected Avaya products:
| Vulnerability | Mitigating Factors |
|---|---|
|
CVE-2014-0160 |
This is a Low risk for Avaya Customer Interaction Express because using the client to connect to untrusted hosts would be considered non-standard user interaction. There is no risk for all other listed products as the affected openssl versions are not installed. |
Additional information may also be available via the Avaya support website and through your Avaya account representative. Please contact your Avaya product support representative, or dial 1-800-242-2121, with any questions.
ALL INFORMATION IS BELIEVED TO BE CORRECT AT THE TIME OF PUBLICATION AND IS PROVIDED "AS IS". AVAYA INC., ON BEHALF ITSELF AND ITS SUBSIDIARIES AND AFFILIATES (HEREINAFTER COLLECTIVELY REFERRED TO AS "AVAYA"), DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE AND FURTHERMORE, AVAYA MAKES NO REPRESENTATIONS OR WARRANTIES THAT THE STEPS RECOMMENDED WILL ELIMINATE SECURITY OR VIRUS THREATS TO CUSTOMERS' SYSTEMS. IN NO EVENT SHALL AVAYA BE LIABLE FOR ANY DAMAGES WHATSOEVER ARISING OUT OF OR IN CONNECTION WITH THE INFORMATION OR RECOMMENDED ACTIONS PROVIDED HEREIN, INCLUDING DIRECT, INDIRECT, INCIDENTAL, STATUTORY, CONSEQUENTIAL DAMAGES, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF AVAYA HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
THE INFORMATION PROVIDED HERE DOES NOT AFFECT THE SUPPORT AGREEMENTS IN PLACE FOR AVAYA PRODUCTS. SUPPORT FOR AVAYA PRODUCTS CONTINUES TO BE EXECUTED AS PER EXISTING AGREEMENTS WITH AVAYA.
V 1.0 - April 8, 2014 - Initial Statement issued.
V 2.0 - April 9, 2014 - Added affected products tables, mitigating factors and link to VPN Gateway information, and changed title.
V 3.0 - April 11, 2014 - Added links to IDE, Scopia and Avaya Services Products statements, and updated mitigating factors.
V 4.0 - April 14, 2014 - Added CM, added tables 2h and 2i, added links to WLAN and Ethernet Switching product statements.
V 5.0 - April 15, 2014 - Added MPS on Windows to table 2e and added table 2j, and updated PC versions.
V 6.0 - April 16, 2014 - Added Gxxx gateways and updated Conferencing risk level and actions, and mitigating factors.
V 7.0 - April 17, 2014 - Added link to EP and T advisory, added table 2k, and updated mitigating factors.
V 8.0 - April 18, 2014 - Added SES to table 2b and added table 2l.
V 9.0 - April 22, 2014 - Added AVAM to table 2a and added table 2m.
V 10.0 - April 24, 2014 - Updated MPS, AVAM mitigating factors and added CMM.
V 11.0 - May 1, 2014 - Added one-X Attendant, C3000 UM, AV3K, I5, IE and
added table 3b and associated mitigating factors table.
V 12.0 - May 9, 2014 - Added AA-SBC.
V 13.0 - May 21, 2014 - Updated Communicator for Android, AACC and WFO actions.
V 14.0 - June 8, 2016 - Set advisory status to Final.
Avaya customers or Business Partners should report any security issues found with Avaya products via the standard support process.
Independent security researchers can contact Avaya at
[email protected].
Linux® is the registered trademark of Linus Torvalds in the U.S. and other countries.
© 2014 Avaya Inc. All Rights Reserved. All trademarks identifying Avaya products by the ® or ™ are registered trademarks or trademarks, respectively, of Avaya Inc. All other trademarks are the property of their respective owners.