Tag: Cyber Security

Categories
Knowledge Support Technical Advisory Bulletins exacqVision EDGE exacqVision Enterprise Support exacqVision Client Other exacqVision Server exacqVision Mobile exacqVision Webservice exacqVision Hardware Products exacqVision Integrations

Support procedure for reporting newly discovered cyber security vulnerabilities in Exacq Software 

This document will outline the procedures expected from Exacq Support staff in the event of discovering a previously unreported security vulnerability in an exacqVision product.

Product 

Any exacqVision product

Procedure:

  1. Verify the vulnerability has not already been properly reported at: https://www.johnsoncontrols.com/cyber-solutions/security-advisories
  2. Email the GPS (Global Product Security) team at: productsecurity@jci.com
    • Provide vulnerability analysis in this email and any relevant links
    • Provide customer details and contact information in this email
    • Provide software product and software versions in this email
    • CC the customer on the email
  3. Inform the customer you have notified the appropriate team (GPS) and will be closing the Support ticket.

Our Global Product Security team will then be responsible for following up with this customer and resolving vulnerability.

<br>

Categories
User Guides Documentation Categories Products

exacqVision 19.03 Hardening Guide

exacqVision-1903-Security-Hardening-Guidev10.pdf
Categories
User Guides Documentation Categories Products

exacqVision v9.2 Hardening Guide

exacqVision-92-Security-Hardening-Guide.pdf
Categories
Knowledge Support Support Categories Products exacqVision Hardware

exacqVision and Heartbleed

In April 2014 a Security Advisory was issued by the OpenSSL project notifying the public of a serious vulnerability in the encryption software used by a large number of companies. (For detailed information, visit http://heartbleed.com/.) Exacq Technologies took immediate action to assess how this affects its products.

<br>

exacqVision uses OpenSSL for a few functions, but the version affected is used only in a small number of exacqVision products:

<br>

exacqVision Server and Client 6.0 for Window

OpenSSL 1.0.1e is used in exacqVision 6.0, released in March 2014. However, the use of this product is not subject to the Heartbleed vulnerability. You can optionally upgrade to the latest version that includes updated OpenSSL at https://exacq.com/support/downloads.php.

<br>

exacqVision S-Series


exaqVision S-Series systems use Ubuntu 12.04, which includes the affected version of OpenSSL. However, only specific non-default configurations expose the system to the Heartbleed vulnerability. See https://exacq.com/kb/?crc=61212 details.

<br>

exacqVision-and-Heartbleed-1.pdf