The CEP software does not use this package or any java-based packages within the software.

The CFNC and TNM software do use this package, but the version installed is not vulnerable. All versions of CFNC use log4j-1.2.16. The versions that are impacted are Log4j2 versions 2.0-beta9 to 2.14.1. 

This includes all versions of CFNC/TNM and CEP software.

If you have any questions, please call the Customer Support line at: +1.888.277.8395 or +1.412.262.2571, option #2 or by email at: support@certesnetworks.com

Certes Networks has updated the CFNC software for the ZTWAN platform. The new version of software has been released and is available from the Customer Portal for download.

CFNC Version 5.4.8504

Release Notes:

CFNC 5.4.8504

Certes Networks has updated the c software for the ZTWAN platform. The new version of software has been released and is available from the Customer Portal for download.

NOTE: All CryptoFlow Network Enforcers running software version 5.2 and earliear must be upgraded to version 5.2a before upgrading to this latest release version 5.4.1.

CFNE Version 5.4.1

Release Notes:

CFNE 5.4.1

Certes Networks has updated the c software for the ZTWAN platform. The new version of software has been released and is available from the Customer Portal for download.

NOTE: All CryptoFlow Network Enforcers running software version 5.2 and earliear must be upgraded to version 5.2a before upgrading to this latest release version 5.2.9.

CFNE Version 5.2.9

Release Notes:

CFNE 5.2.9

Certes Networks has updated the c software for the ZTWAN platform. The new version of software has been released and is available from the Customer Portal for download.

NOTE: All CryptoFlow Network Enforcers running software version 5.2 and earliear must be upgraded to version 5.2a before upgrading to this latest release version 5.2.7.

CFNE Version 5.2.7

Release Notes:

CFNE 5.2.7

Are Certes products impacted by Spectre / Meltdown?

Yes. All modern CPU’s of the last 10 years or so are impacted.

What is the risk from using Certes products due to the Spectre / Meltdown vulnerabilities?

Certes believe the risk is quite low. These vulnerabilities require local access to the OS and the ability to run your own malicious code on the Certes platforms. Certes solutions are NOT multi-user or open to allow others to run their own code on our solution. Provided that customers have taken appropriate steps to prevent unauthorized access to Certes’ enforcer and management platforms then the risk is low.

What is Certes doing to address these Vulnerabilities?

Certes is monitoring the availability of patches. The first round of fixes for Spectre have been pulled by Intel. We are watching the situation closely and will apply and test the patches in our lab before inclusion in a future release of the software, if applicable. We will provide updates as more information becomes available.

If you have any questions, please call the Customer Support line at:

+1.888.277.8395

or

+1.412.262.2571, option #2

or by email at:

support@certesnetworks.com

Summary:

On May 1, 2017, Intel published a Security Advisory regarding a critical firmware vulnerability in certain systems that utilize Intel® Active Management Technology (AMT), Intel® Standard Manageability (ISM) or Intel® Small Business Technology (SBT). The vulnerability could enable a network attacker to remotely gain access to business PCs or devices that use these technologies. Consumer PCs with consumer firmware and data center servers using Intel® Server Platform Services are not affected by this vulnerability.

However, malicious users could only exploit the vulnerability with access to the Certes’ products’ management ports or management interfaces, which under operational best practices should be secured from intrusion. All Certes' product users are advised to ensure their management networks are secure and access to management ports is strictly controlled.

Please visit the link below for a complete explanation of CVE-2017-5689:

CVE-2017-5689

Affected Certes Products:

Recommendation:

Or as an upgrade alternative please follow the manual procedure linked below:

 CVE-2017-5689 Upgrade Procedure

If you have any questions, please call the Customer Support line at:

+1.888.277.8395

or

+1.412.262.2571, option #2

or by email at:

support@certesnetworks.com

Certes Networks has updated the CFNC software for the ZTWAN platform. The new version of software has been released and is available from the Customer Portal for download.

CFNC Version 5.2.8220

Release Notes:

CFNC 5.2.8220

Certes Networks has updated the CFNE software for the ZTWAN platform. The new version of software has been released and is available from the Customer Portal for download.

NOTE: All CFNEs must be upgraded to version 5.2a before upgrading, if the current version is older than version 5.2.

CFNE Version 5.2.2

Release Notes:

CFNE 5.2.2

Certes Networks has updated the CFNC software for the ZTWAN platform. The new version of software has been released and is available from the Customer Portal for download.

CFNC Version 5.2.8218

Release Notes:

CFNC 5.2.8218

Certes Networks has updated the CFNE software for the ZTWAN platform. The new version of software has been released and is available from the Customer Portal for download.

NOTE: All CFNEs must be upgraded to version 5.2a before upgrading to this latest release version 5.2.1.

CFNE Version 5.2.1

Release Notes:

CFNE 5.2.1

Certes Networks has updated the CEP software for the ZTWAN platform. The new version of software has been released and is available from the Customer Portal for download.

CEP Version 4.0.4J

Release Notes:

CEP 4.0.4J

Certes Networks has updated the CFAC and CFAE software for the ZTAC platform. The two new versions of software have been released and are available from the Customer Portal for download.

CFAC Version 2.2.stable3

Release Notes:

CFAC 2.2.stable3

CFAE Version 2.2.0028

Release Notes:

CFAE 2.2.0028

Certes Networks has updated the CFNE and CFNC software. Two new versions of CEP software have been released and are available from the Customer Portal for download:

CFNE Version 5.2

Release Notes:

CFNE 5.2

CFNC Version 5.2.8123

Release Notes:

CFNC 5.2.8123

Summary:

Certain Certes’ TrustNet Manager Products run versions of OpenSSL that are vulnerable to remote unauthorized access via a man in the middle attack. Remote access is gained by a malious user intercepting the ClientHello and ServerHello during a TLS handshake betwen the client and server forcing a ciphersuite downgrade from DHE to DHE-EXPORT. However, the vulnerability could only be exploited by malicious users with access to the Certes’ products’ management ports or management interfaces, which under operational best practices should be secured from intrusion. All Certes' product users are advised to ensure their management networks are secure and access to management ports is strictly controlled.

Description:

A vulnerability in the TLS protocol handshake version 1.2 and earlier allows malicious man in the middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE.

Please visit the link below for a complete explanation of CVE-2015-4000:

CVE-2015-4000

Affected Certes Products:

TrustNet Manager server: all versions 4.0.6775 and earlier.

Recommendation:

Upgrade TrustNet Manager to version 4.0.6786 or 3.5.6784.

Or as an upgrade alternative please follow the manual procedure linked below:

 CVE-2015-4000 Manual Procedure

If you have any questions, please call the Customer Support line at:

+1.888.277.8395

or

+1.412.262.2571, option #2

or by email at:

support@certesnetworks.com