ZombieLoad FAQs for Smart Suite 5.x

OVERVIEW: 

ZombieLoad (Microarchitectural Data Sampling (MDS)) is a vulnerability that an attacker can execute if they have shell access to an affected server, it could allow data in the CPU's cache to be accessed. An attack could use this vulnerability to read memory from the CPU. This memory may include passwords, website content, or disk encryption keys. 

Remediation  

Patches to prevent memory access by non-authorized processes have been developed by Microsoft and the Linux community.  For those customers utilizing Microsoft products Spok recommends staying up to date with the latest patch releases.  

FAQs 

Q: When will this patch be available?
A: Smart Suite 5.x customers, please see the below response from Red Hat:

    "At this time, based on the severity of these issues, where Red Hat Enterprise Linux 5 is in its support lifecycle, and the low number of CPU types that will have available microcode that is required for these mitigations, RHEL5 will not be addressed."
    https://access.redhat.com/security/v...rabilities/mds

Q: What if my servers are running in a virtual environment?
A: If you have virtualized your Spok environment please work with the Virtualization vendor to ensure all applicable patches have been applied to the virtual host.
    
Q: Will Spok apply patches to our windows systems?
A: Spok does not provide administrative services for Windows Systems.  Please work with your OS vendor for patches required for Windows.  Please note that there are some Spok Mobile specific registry settings that if changed, could negatively impact the performance of your Spok Mobile.  If you have questions about security concerns regarding registry settings, please open a case with Spok Support to ensure you don't negatively impact Spok applications.  Spok also suggests that you apply any OS Patches to a test system first to ensure you minimize potential production issues.

Q: Should my hardware be updated?
A: For those customers who purchased Dell and HP hardware, we recommend that you apply applicable BIOS updates as recommended by those manufacturers.   Please work directly with your hardware vendor for Service plan or Warranty questions.

If you have additional questions or need further clarification, please open a new support case through the Spok Community by clicking on "Create new case".