October 17, 2014 OpenSSL POODLE Vulnerability Assessment for Brocade Revision 1.0 Vulnerabilities: CVE-2014-3566: The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue. Vulnerability Statement: Statement of vulnerability from OpenSSL.org Summary: Select Brocade products use the OpenSSL package and may be impacted by this vulnerability. Brocade is working to develop a comprehensive plan to address this issue in all vulnerable products. This notice will be updated as more information becomes available. Where there are impacts and fixes these will be published in product-specific TSBs. Initial Assessment of Vulnerability for Brocade Products Product Current status Network Advisor The following releases are impacted Network Advisor 12.0.x to 12.3.x and Network Advisor 11.0.x to 11.3.x (If SSL is enabled) Fabric OS Impacted. Network OS Under investigation. NetIron Impacted FastIron Impacted. BigIron RX Under investigation. ServerIron ADX Impacted. ServerIron JetCore Impacted Virtual ADX Impacted. Vyatta vRouter Impacted. ARB Under investigation. ServerIron-XL Under investigation. IronView Network Manager Impacted USD-X Under investigation. DCFM All DCFM releases impacted if SSL enabled. Brocade Mobility Controllers Under investigation. Product Current status Brocade Mobility Access Points Under investigation. Brocade Monitoring, Analytics, and Remote Troubleshooting Environment  Under investigation Brocade IT  Systems are currently being scanned to determine any vulnerability and results will posted by 10/21. Disclaimer THIS DOCUMENT IS PROVIDED ON AN AS-IS BASIS SOLELY FOR INFORMATIONAL PURPOSES AND DOES NOT IMPLY ANY KIND OF GUARANTY OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. YOUR USE OF THE INFORMATION CONTAINED HEREIN IS AT YOUR OWN RISK. ALL INFORMATION PROVIDED HEREIN IS BASED ON BROCADE’S CURRENT KNOWLEDGE AND UNDERSTANDING OF THE VULNERABILITY AND IMPACT TO BROCADE HARDWARE AND SOFTWARE PRODUCTS. BROCADE RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. Document Revision 1.0 Changes First release page 2