Heartbleed is a major online security vulnerability in a widely used, open-source encryption library named OpenSSL. The OpenSSL library is found in nearly 70% of all webservers on the internet as well as many other software products. The vulnerability allows any attacker to compromise the private encryption key of the webserver. It also allows any attacker the ability to remotely read pieces of data directly out of the server’s memory. These are both extremely serious flaws. The fix requires IT staff to first update the OpenSSL library, then replace the SSL certificate with a new one. This is both time consuming and costly. If you are running any Linux-based webserver, particularly any on the public internet, you need to immediately check the version of OpenSSL and remediate if required.
Note that this vulnerability does not exist on a standard Windows web server running IIS.
The most recent release of VMware ESXi, version 5.5, is affected by the bug and there is no patch currently available. Standard security practice is to segment the management IP addresses from the rest of your network to prevent a malicious user from compromising your vSphere host. If you are running 5.5 and you have not segmented the management network, do so immediately. This is the only workaround available as of April 10th, 2014 at 10:15AM Central
Technical details on the bug can be found here:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160
Here are official releases from various vendors on this vulnerability:
Cisco – http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-heartbleed
Juniper – http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10623
Citrix – http://support.citrix.com/article/CTX140605
Fortinet – http://www.fortiguard.com/advisory/FG-IR-14-011/
Barracuda – No official statement found, although I have verbal confirmation that multiple Barracuda products are vulnerable. A patch already exists for the Message Archiver product.
Palo Alto Networks – http://researchcenter.paloaltonetworks.com/2014/04/palo-alto-networks-addresses-heartbleed-vulnerability-cve-2014-0160/