Protecting Intershop against ‘Meltdown’ and ‘Spectre’ vulnerabilities

Two vulnerabilities are in the news right now Spectre and Meltdown and everyone but those who are affected is talking about. Both vulnerabilities are really bad news for CPU manufacturer like Intel, AMD and ARM.

The following vulnerabilities are registered in the National Vulnerability Database:

• • CVE-2017-5753 — Spectre (Variation 1)
    Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.
  • CVE-2017-5715 — Spectre (Variation 1)
    Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.
  • CVE-2017-5754 — Meltdown (Variation 3)
    Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.

As an Intershop partner or customer you might ask yourself: “How does this effect my business?”. As swapping out CPUs from your servers isn’t an option, manly because across the board every manufacturer seems to be affected, what can I do? Actually not much. But there are a few things which you can do:

• Get newest OS updates for your servers if you hosting your infrastructure yourself;
• or ask you hoster or cloud provider if they have installed updates for their OSs;
• certain updates are slowing down the machines so make sure you can gain the same performance as before;
• as Spectre and Meltdown are vulnerabilities which need to run locally make sure no unauthorized access to your servers is possible;
• that being said it might be possible to use those vulnerabilities in a clients browser so make sure that you are using only well known JavaScript libraries so you are not putting your customers at risk.

Overall even this is in everyone’s mouth in the IT industry and every major CPU manufacturer is affected if your servers are secure, so do you. You need to be able to execute code locally on a server in order to exploit those vulnerabilities. This means that you are actually safe with Intershop and a fairly tightened infrastructure only exposing 80/443 from your WebServers. And if an attacker has broken into your servers Spectre and Meltdown are the least of your problems.

Even though we will keep them in mind for sure and we will analyze exploits as soon as they hit surface.