August 14th, 2016 Riverbed Security Advisory for the SteelCentral NetShark feature in RiOS

The SteelCentral NetShark feature in RiOS is using an outdated version of OpenSSL (0.9.8k) which includes several known security vulnerabilities.  This advisory is only applicable to the SteelCentral Netshark feature in RiOS - this advisory is not applicable to the standalone SteelCentral NetShark product.

Please note: To receive real-time updates on this article, please click the Subscribe icon in the upper right corner of this article. Updates will be emailed to you as they are published. For additional information on how to subscribe, see S22384.

SteelHead | SteelCentral | SteelFusion | SteelConnect | Websites

SteelHead products 

Starting in RiOS 9.1.4, RiOS 9.2.1, and all products that use these versions of RiOS, e.g. SteelFusion Edge, NetShark functionality will no longer be visible as a configurable option.  The functionality will continue to be available for configuration via hidden commands in the command line interface, and operate unaltered.  While the functionality will continue to be available, customers are encouraged to disable it.
 

Workaround

Customers with NetShark enabled in RiOS, including the deprecated versions, should disable this feature.

Disable From Command Line Interface:

Execute the following commands.

1. enable
2. configure terminal
3. no cascade shark enable
4. username shark disabled 

 Disable From Web Interface: 

1. Browse to Reports > Diagnostics > TCP Dumps
2. Uncheck “Enable SteelCentral™ NetShark”
3. Press Apply
4. Browse to Administration > Security > User Permissions
5. Expand user row “shark”
6. Uncheck “Enable Account”
7. Press Apply 

Analyzing Traffic without Integrated SteelCentral NetShark:

SteelHead packet captures can be manually loaded into the SteelCentral Packet Analyzer for anlaysis without SteelCentral NetShark enabled.

1. Browse to Reports > Diagnostics > TCP Dumps
2. Create a new sysdump in "TCP Dumps Currently Running"
3. Once packet capture ends, or is manually terminated, expand the TCP Dump in "Stored TCP Dumps"
4. Click the "Download" Link
5. Download the packet capture into a computer that has SteelCentral Packet Analyzer installed
6. Start Packet Analyzer and click on "Add Trace File", selecting the downloaded packet capture

Back to top

SteelCentral products

Back to top

SteelFusion products

Refer to the SteelHead section for further details.

Back to top

SteelConnect products

Back to top

Riverbed websites

• Not Impacted

Back to top