High Risk on DMP 4400 and 4310 "OpenSSL MITM CVE-2014-0224"

I cannot find a patch to fix the problem - is there a fix or should I create a TAC case?
DMM version - 5.3.0
4310 and 4400 - version 5.4.1

Here is what I received for the Dell Response to Openssl vulnerability.
After a couple of calls to technical support here is what I'm getting for my iDRAC7 getting flagged by Foundstone security scans for the vulnerability CVE-2014-0224:
" The OPEN SSL package used here contains multiple components, the component that is impacted and vulnerable is not being used, other components in this package are being used but aren't vulnerable".
"Dell has determined that the products listed in the attached document are not affected by the vulnerabilities. Some products have leveraged an older (but not vulnerable) OpenSSL module. These could be flagged by a scanner. Dell is currently working on updating the modules to a version that will not be flagged for these issues".
I've also attempted to upload the document, hopefully it can be viewed or downloaded.
If this post has helped you please rate it.
Thanks
2376.Dell-ResponseOpenSSLSecurityAdvisory_05_June_2014_final.pdf

Similar Messages

OpenSSL vulnerability CVE-2014-0224

My customer want to know whether ASE is affected by the following OpenSSL vulnerability in http://www.openssl.org/news/secadv_20140605.txt
      SSL/TLS MITM vulnerability (CVE-2014-0224),
      DTLS recursion flaw (CVE-2014-0221)
      DTLS invalid fragment vulnerability (CVE-2014-0195)
      SSL_MODE_RELEASE_BUFFERS NULL pointer dereference (CVE-2014-0198)
      SSL_MODE_RELEASE_BUFFERS session injection or denial of service (CVE-2010-5298)
      Anonymous ECDH denial of service (CVE-2014-3470)
Can you help me to confirm the above question?

You have clearly double posted this question in two groups.
So the first question goes back to you.
Are you Running SAP Applications on ASE, if so this is not the proper group?

Can we play more than one video on same screen on DMP-4400,4600,4310.

We are making custom slide and playing single video on slide(screen),but we ahve a requirement of playing multiple videos on single slide(screen).Please tell us if this is possible on on DMP-4400,4600,4310.

Yes you can. It is covered in the FAQ...
iPod: Frequently Asked Questions
http://docs.info.apple.com/article.html?artnum=60920
Patrick

OpenSSL SSL/TLS Man-In-The-Middle Injection Attack CVE-2014-0224

Can some help me to fix Open SSL Issue in Windows server 2008 R2 CVE-2014-0224 , Please advice

Hi,
From the description on Open SSL site, it is fixed in newer versions so could you update to the new version?
https://www.openssl.org/news/vulnerabilities.html
Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.
CVE-2014-0224: 5th June 2014
An attacker can force the use of weak keying material in OpenSSL SSL/TLS clients and servers. This can be exploited by a Man-in-the-middle (MITM) attack where the attacker can decrypt and modify traffic from the attacked client and server. (original advisory).
Reported by KIKUCHI Masashi (Lepidum Co. Ltd.).
Fixed in OpenSSL 1.0.1h (Affected 1.0.1g, 1.0.1f, 1.0.1e, 1.0.1d, 1.0.1c, 1.0.1b, 1.0.1a, 1.0.1)
Fixed in OpenSSL 1.0.0m (Affected 1.0.0l, 1.0.0k, 1.0.0j, 1.0.0i, 1.0.0g, 1.0.0f, 1.0.0e, 1.0.0d, 1.0.0c, 1.0.0b, 1.0.0a, 1.0.0)
Fixed in OpenSSL 0.9.8za (Affected 0.9.8y, 0.9.8x, 0.9.8w, 0.9.8v, 0.9.8u, 0.9.8t, 0.9.8s, 0.9.8r, 0.9.8q, 0.9.8p, 0.9.8o, 0.9.8n, 0.9.8m, 0.9.8l, 0.9.8k, 0.9.8j, 0.9.8i, 0.9.8h, 0.9.8g, 0.9.8f, 0.9.8e, 0.9.8d, 0.9.8c, 0.9.8b, 0.9.8a, 0.9.8)
If you have any feedback on our support, please send to [email protected]

DMP-4400 5.1 When Live stream drops the DMP requires reboot

We are using the Exterity TV Gateway to stream live TV to our DMP's when the Signal drops on the Exterity as it does several times a day the TV looses Audio and the screen goes blank for 5 seconds shows video and then blank again. This continues until we reboot the DMP. Has anybody come across this issue and does anybody have any ideas on a cure? The network connections are ok at the Exterity and DMP as far as speed and duplex are concerned with no errors seen. I am thinking its something to do with the multicast and the time its taking to re-join the stream but not sure how I can make any ajustments if it is.

Hi,
Do you have a resolution for this?
I'm getting a similar issue running the DMP 4400 and DMM 5.1 except I have and issue where I could get 2 channels ok but could not get others and getting the blank screen repeatedly. Rebooting the DMP does not seem to provide any resolution temporarily or not. I have a DMM, DMP and DCM all attached to the same switch. Using UDP media per channel and a presentation per channel to push TV the DMPs.
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
mso-para-margin:0cm;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:"Times New Roman";
mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;
mso-bidi-font-family:"Times New Roman";
mso-bidi-theme-font:minor-bidi;}
Using VLC to pickup the mutlicasts works without any issues.

DMP 4400 v5.4 and DMM 5.2.2 Registration

Please let me know, the DMP 4400 with running version 5.4 will register in DMM running version 5.2.2 or not ??
Should I need to upgrade the DMM to 5.2.3 or higher?
Regards,
Nishant

Hi John,
Thanks for the reply..
We already have server setup with version 5.2.2 and now planning tu place order of new 4400 DMP's. New DMPs are coming with 5.4 version. So what is the best method to implement?
Can we downgrade the DMP firmware? or any other workaround is there?
Please reply..

Norton detected lightroom files as high risk files and removed those

Hi.
My Norton 360 detected following files as high risk files and removed those
-mc_config_mp2v.dll
-mc_config_avc.dll
Now lightroom do not work properly
This happened both lightroom 4.1 rc1 and rc2.
Should I configure Norton to accept those files or are there alternative solution/correction.

Yes, known issue (Norton being overly sensitive). Unquarantine the files and you should be OK.

Java and "High Risk Activities"

The java license says that it "is not designed, licensed, or intended for use in the design, construction, operation or maintenance of any nuclear facility ("High Risk Activities")."
I think this must have something to do with GC? Can anyone explain what is required to make java suitable for "High Risk Activities"? I might have some work with the Russian atomic energy agency coming up.

design, construction, operation or maintenance of any nuclear facility...
"Design" and "construction" rule out CAD design tools written in Java, and UML design tools for software engineering, if you interpret the license very restrictively.
It seems to me that it is a remain from the Cold War era.
I can't say if they simply have written a disclaimer (we at Sun can not be responsabilized by the Three Mile Island or the Chernobyl incidents because Java can't be used at such sites...), or they think that Java is a weapon (like strong cryptography)...
I agree with the conditions "operation" or "maintenance" - plain old Java, without real-time extensions, suffers with the unpredictability of response time due to garbage collection cycles - even if you pass a lot of parameters to the JVM, like -XX+UseParallelGC . (Plain old Linux has such problem as well, so you need to use some Linux distro that implements real-time extensions, or better, an operating system that is designed from the ground up to support real-time operations, like QNX).
I am not a lawyer; please check the license with someone.

DMP 4400 Browser Command for refreshing Currently Playing URL

Looking for a "SET" command that will allow me to refresh the "Currently Playing URL" without rebooting the DMP.
I need a refresh BROWSER URL command so that Users do NOT have to repush unique individual Presentations when making a change to a shared / referenced Playlist, but rather have the ability to select a single System Task that would issue the refresh Browser URL command.
I'm aware of the following command, but this requires the specific URL to be known, which defeats the purpose of having a general URL refresh command:
http://<dmp_ip>:7777/set_param?mng.command=start+video+<URL>
Anybody know if other param / syntax options exist for accomplishing this task?

Hi Mark,
I went as far as disassembling the sysmng binary and I found a number of features I hadn't known about the existence of before, but nothing that I can clearly identify as causing a refresh.
I've been trying to get my hands on a development reference or something because there are probably more than 100 functions and I only know what several dozen of them do. Then there are differences between the 4310/4400 presentation mechanisms. Sounds like I need to power on a 4400 and poke around at it.
The approach we're using on the 4310 is to load a local page stored on the DMP in file://tmp/ftproot/usb_1 , and that happens to be a .swf flash template that listens to remote commands to refresh or reload or do whatever we want to it. We control it as an interactive function of the .swf itself rather than via sysmng commands.
So for us, the second command below to reload always points to the same file://xxxxx path and we don't need to independently determine the playback URL.
Another idea would be to point the playback URL to file://xxxxxx/file.html and have that frame or refresh external content. But then you would have to manage "file.html" on the DMP and execute the second refresh command below. You say that server side execution isn't going to work for you, but perhaps scp/sftp of a file containing the presentation URL would work for you instead?
Or... say, using the sysmng function to execute a wget command, to stage file.html on the DMP's file system? Have never tried that but that goes to illustrate that there are a lot of different ways to accomplish something on the player.
If I find a better answer about a built in function being a /better/ way to accomplish that (or if I stumble on something unique to the 4400) I will let you know.

SSRS-2008 reports problem in DMP 4400 standalone(tvzilla)

Hi guys,
Does anyone knows how I can to render SSRS-2008 reports in DMP 4400 standalone and its browser(tvzilla = Firefox 2.0.0.18) ?
My frimework version on DMP is 5.4.1(lastest)
I google for it and found something like an answer, but it seems to be mostly for Safari and Chrome...
http://stackoverflow.com/questions/5968082/ssrs-2008-r2-ssrs-2012-reports-are-blank-in-safari-and-chrome
Thank you in advance !
Regards,
Hristo.

Hoang,
In SSRS 2005, white spaces are automatically ignored. But in 2008 this behavior gets changed and by default whitespaces are not ignored. But, There is Report property
ConsumeContainerWhitespace which is set to False by default. We can remove blank space at end by setting
ConsumeContainerWhitespace to true.
The logic to prevent the unnecessary pagebreak is
- ReportBody width should be less then Pagesize(width) – Left Margin – Right Margin
- ReportBody height should be less then Pagesize(Height) – Top Margin – Bottom Margin – Header height – Footer height
Thanks, Sandip Please "Mark as Answer" if this resolves your problem or "Vote as Helpful" if you find it helpful.

Error Adding DMP 4400 to DMM 5.2.2

I am trying to add a new DMP to my DMM system and everytime I input the IP and MAC on the DMM for the DMP and click ok to add I get the following error code.
DMP could not be added. Error 400
Any Ideas as to what this error code is. I have serched and am unable to find any information on error codes for DMM.
DMP:
DMP-4400
5.2.2
DMM:
Version ID: V5.2.2
HW Model: MCS-7835-H3

Hello,
1) Do you have a firewall in your network, If Yes - Have you opened the necessary ports on it ?
Please refer to the ports that need to be allowed between the DMP and DMM.
http://www.cisco.com/en/US/docs/video/digital_media_systems/5_x/5_2/showandshare/admin/guide/appports.html
2) Error Code 400 could be the HTTP Error code, Which means that the request from the client to the server or vice versa was not understood by the receiving end.
3) Makes sure the DMP and DMM are running the same code version and nothing is blocking port 7777 between them.
4) A screenshot of the error would be helpful .
Thanks,
Sagar Dhanrale

Dmp 4400 can't play local files

I am using a DMP-4400 with firmware v.5.2.2. The unit connects to the network fine and is able to display webpages from the internet without problem; the ftp server is working fine also. However, when I attempt to play any type of local file ( located at /tmp/ftproot/usb_1/) the screen remains blank. I am assuming that the files are being found because the failover URL is not being displayed for either .mpg or .html files. I am using MPEG-1 type video files for testing. I have attached one of these videos along with a sample .html file I am planning to use to loop multiple files.
Video files are being run using:
"/tmp/ftproot/usb_1/melt.mpg" entered into the 'Local Storage Path' dialog under 'Play Video File Stored Locally' within the GUI.
HTML is being launched using:
"file:///tmp/ftproot/usb_1/play-local-mpg.html" entered into the 'URL' dialog under 'URL To Be Displayed' within the GUI.
These problems persist whether the files are located on internal memory or external USB drive. Any help will be much appreciated.

Peter,
I was able to fix it, The issue seems to be with the content, I transcoded it with VLC Player to MPEG-TS and it works. Kindly find the attached transcoded file.
Use
var playlist = new Array(
"file:///tmp/ftproot/usb_1/test1.ts"
If this answers your concerns please mark this post as "Answered"
Thanks,
Sagar Dhanrale

High Risk Vendor PO Approval Process

Hi All,
We have a requirement where in we classify few vendors as High Risk Vendors at the Supplier Header Level. When PO is created, the requirement is not to block the Permanent creation of PO, but to do extra check/validation/approval by compliance/controllership team. Is there any way to route the approval for High Risk Vendors to compliance team for another round of approval ?
Thanks,
Shilpa.

Seeded Oracle workflow approval does not provide this.
An easier out will be to generate a FYI notification to the compliance team when such a PO is approved. This way, they can intervene after-the-fact. Is that acceptable?
The other option is to define a new Hierarchy. In the hierarchy, the compliance team is the first approver with $0.01 limit. And then subsequent approvers come into picture. The disadvantage is that the user will have to select appropriate hiearchy.
You can consider a personalization on the Approve PO screen that forces user to select the new hierarchy if the vendor is HIGHRISK.
Hope this helps,
Sandeep Gandhi

DMP 4400 will quickly flip every other image. Why?

So we have several DMP 4400s installed and managed through the DMM. Often some of the DMPs will start flipping quickly past every other image in the playlist although they are all timed to change at 25 secs or so. All images in the playlist are png. When first uploaded the signage will behave normally and then for no apparent reason they start with this issue. The problem does not occur on all of our DMPs and will occasionally appear to correct themselves. We have seen the problem in both 5.2.1 and 5.2.2 firmware versions.
If we use Flash the problem does not appear however it is time consuming to update all of the DMPs and can not be done quickly.
Has anyone seen this and can you offer a solution?
David

So we have several DMP 4400s installed and managed through the DMM. Often some of the DMPs will start flipping quickly past every other image in the playlist although they are all timed to change at 25 secs or so. All images in the playlist are png. When first uploaded the signage will behave normally and then for no apparent reason they start with this issue. The problem does not occur on all of our DMPs and will occasionally appear to correct themselves. We have seen the problem in both 5.2.1 and 5.2.2 firmware versions.
If we use Flash the problem does not appear however it is time consuming to update all of the DMPs and can not be done quickly.
Has anyone seen this and can you offer a solution?
David

What's a high risk merchant account online?

For some industries, merchant accounts can be more difficult to obtain as they are thought to be a high risk by the merchant account provider. Such industries include:
+• Replica Products • Dating • Telemarketing • Adult • Multi-Level Marking • Cell Phone • Auctions • Travel • Pharmacy • Gambling • Pornography •+
Banks and third party merchant account providers consider these industries a higher risk due to a higher level of charge backs, returns/refunds and credit card fraud. As a result of the high risk associated for the provider of the merchant account, there are higher rates associated with merchant accounts.
It can be difficult to obtain a high risk merchant account from a bank and in most cases can also be quite expensive. Typically speaking, banks do not provide merchant account services to high risk merchants, if they do their rates will be higher than available from a third party provider. Third party merchant account providers can provide accounts to high risk merchants as they have relationships with multiple banks, allowing them to ‘spread’ around the risk.
Due to many competing third party providers, rates for high risk merchant accounts can be significantly lower than those from a bank. However, the rates will be higher in order to offset the risk involved. Typically, application fees for a high risk account range from $500 to $5000, though not all providers charge application fees. Then there are two charges that occur each time a transaction is processed:
+• The transaction fee is a flat rate fee between $0.35 and $0.75+
+• The discount rate is a percentage of the transaction amount, and is usually anywhere from 3% to 15% for a high risk merchant.+
Other fees include monthly statements and services such as fraud protection, as well as charges for refunds and charge backs.
[email protected]
[Emerchantpay - High risk merchant account processor|http://www.emerchantpay.com]

For some industries, merchant accounts can be more difficult to obtain as they are thought to be a high risk by the merchant account provider. Such industries include:
+• Replica Products • Dating • Telemarketing • Adult • Multi-Level Marking • Cell Phone • Auctions • Travel • Pharmacy • Gambling • Pornography •+
Banks and third party merchant account providers consider these industries a higher risk due to a higher level of charge backs, returns/refunds and credit card fraud. As a result of the high risk associated for the provider of the merchant account, there are higher rates associated with merchant accounts.
It can be difficult to obtain a high risk merchant account from a bank and in most cases can also be quite expensive. Typically speaking, banks do not provide merchant account services to high risk merchants, if they do their rates will be higher than available from a third party provider. Third party merchant account providers can provide accounts to high risk merchants as they have relationships with multiple banks, allowing them to ‘spread’ around the risk.
Due to many competing third party providers, rates for high risk merchant accounts can be significantly lower than those from a bank. However, the rates will be higher in order to offset the risk involved. Typically, application fees for a high risk account range from $500 to $5000, though not all providers charge application fees. Then there are two charges that occur each time a transaction is processed:
+• The transaction fee is a flat rate fee between $0.35 and $0.75+
+• The discount rate is a percentage of the transaction amount, and is usually anywhere from 3% to 15% for a high risk merchant.+
Other fees include monthly statements and services such as fraud protection, as well as charges for refunds and charge backs.
[email protected]
[Emerchantpay - High risk merchant account processor|http://www.emerchantpay.com]

High Risk on DMP 4400 and 4310 "OpenSSL MITM CVE-2014-0224"

Similar Messages

Maybe you are looking for