CVE-2020-14483 : Security Advisory and Response

A timeout during a TLS handshake can result in the connection failing to terminate, causing a Niagara thread to hang and requiring a manual restart of affected versions.

Understanding CVE-2020-14483

This CVE involves a vulnerability in the Niagara and Niagara Enterprise Security products.

What is CVE-2020-14483?

The vulnerability leads to a timeout issue during a TLS handshake, which can prevent the connection from properly terminating.

The Impact of CVE-2020-14483

The vulnerability can cause a Niagara thread to hang, necessitating a manual restart of affected versions to resolve the issue.

Technical Details of CVE-2020-14483

This section provides more technical insights into the CVE.

Vulnerability Description

The vulnerability involves a timeout during a TLS handshake, resulting in connection termination failure.

Affected Systems and Versions

Product: Niagara
Versions: 4.6.96.28, 4.7.109.20, 4.7.110.32, 4.8.0.110
Product: Niagara Enterprise Security
Versions: 2.4.31, 2.4.45, 4.8.0.35

Exploitation Mechanism

The issue arises due to synchronous access of remote resources without a timeout (CWE-1088).

Mitigation and Prevention

Steps to address and prevent the CVE.

Immediate Steps to Take

Restart affected Niagara and Niagara Enterprise Security versions.
Monitor for any abnormal behavior post-restart.

Long-Term Security Practices

Regularly update and patch affected systems.
Implement network segmentation to limit exposure.

Patching and Updates

Apply vendor-supplied patches promptly.
Stay informed about security advisories and updates.