What you need to know so you Don’t Meltdown from Spectre! How to patch your computers.
So the world is ablaze again from the latest computer vulnerability. Make that 2 of them. And they affect pretty much every computer made in the last 20 years. AWESOME. Thankfully the patches are coming out as fast as the snow is falling in the northeast. Here’s a rundown of the stuff I’ve researched for myself and clients today in regards to the latest vulnerabilities.
Background:
Although they work differently, these hardware bugs both allow programs to steal data which is currently processed on the computer. They do not cause any corruption or data loss though like Ransomware (think WannaCry). Meltdown and Spectre use malicious programs to get hold of secrets stored in the memory of other running programs across the processors. Sometimes in shared environments. Both attacks use side channels to obtain the information from the accessed memory location.
Detection Tool: [Please note this tool is not the correct detection tool for Spectre or Meltdown as noted in the comments but does address another vulnerability which my system WAS not patched for)
There is a pretty easy to use detection tool provided by Intel. Go download it (Windows or Linux), run the GUI and see if your system is vulnerable. Mine was.
https://downloadcenter.intel.com/download/27150
Since i have a Dell laptop, I went over to Dell.com, popped my Express tag into the support section and was given a list of all of the drivers and BIOS updates available to me. A quick round of installs (including a FLASH update) and I ran the Intel assessment tool again.
All good on the Smart Home front.
For the vendors that many of my clients use, here are the particular details:
Nutanix:
Nutanix has issued an advisory on the exploits. Only the newest G6 series blocks will need a BIOS patch.
VMware ESXi:
VMware is not vulnerable to Meltdown but have released patches for Spectre. These patches are available in Update Manager and documented here. Be sure to update your ESXi hosts.
- ESXi 5.5, 6.0, and 6.5 (install relevant patches: ESXi550-201709101-SG, ESXi600-201711101-SG, ESXi650-201712101-SG)
Citrix:
https://support.citrix.com/article/CTX231399
The products Citrix believes may be affected are Citrix Netscaler SDX and Citrix XenServer. Netscaler MPX and VPX are not affected though.
Microsoft:
Microsoft has issued it’s latest round of Tuesday patches that will also address these vulnerabilities. Firmware updates will most likely be needed though for complete protection. Antivirus protection also complicates this as noted in a Microsoft Bulletin.
Happy Patching!
-CARLO