-3.jpg?width=1000&name=Untitled%20design%20(15)-3.jpg)
Ultima is aware of two major security flaws that have surfaced and are thought to affect all Intel and some AMD & ARM processors.
The exploits, called Meltdown and Spectre, take advantage of the processors’ hardware rather than a software flaw, so it circumvents security schemes built into major operating systems. The hardware manufacturers have begun working on fixes; information on some of the progress can be found on the links below. Ultima recommends that all vendor fixes and patches are applied when made available.Please refer to this helpful Google blog post which was released upon discovery, found here.
ARM says some of it’s high-end Cortex A processors are vulnerable, but that it’s Cortex-M products - heavily used in low-power IoT systems - are not. The full list and some technical details are here. You can find Intel’s statement here.
At this stage the exact impact on systems are unknown but any performance impacts are workload dependant and, for the average computer user, should not be significant and will be mitigated over time.
As it stands there are no known exploits that take advantage of these vunerabilities, however, following good security practice will help mitigate several of the avenues of attack; such as, not giving applications root permissions and limiting access to machines as much as possible.
Patching, although critical, should be done via a rigorously tested process as effects of the CPU patches are unpredictable and affect servers, desktops and mobile devices in different ways. Even systems that are similar can behave differently to the patch.
Vendor Updates:
Check Point has released an IPS update to help protect against these exploits - click here for details.
Cisco has published an update on their security site - found here.
HPE has released a customer statement and security bulletin.
Dell has advised the following:
We highly recommend you bookmark the following pages where we will be publishing the latest information on affected Dell / Dell EMC products including BIOS updates as they are available.
- Dell Client
- Dell Enterprise (Dell Servers, Storage and Networking)
- RSA (customer login required)
- Dell EMC Storage & Data Protection (customer login required)
- Dell EMC CPSD (customer login required)
In addition, Dell recommends customers follow security best practices for malware protection to protect against possible exploitation of these analysis methods. These practices include promptly adopting software updates, avoiding unrecognised hyperlinks and websites, and following secure password protocols.
