How to fix Meltdown and Spectre-ManageEngine Endpoint Central

Security professionals had a hectic start to 2018 with the discovery of two critical processor bugs—Meltdown and Spectre. Without diving too far into the details, these bugs can be described as a family of vulnerabilities that allow processes to access data;that is normally inaccessible to them.* Theoretically, hackers can leverage these flaws to access confidential data,including passwords, email IDs, cryptographic keys, and more.

See what industry experts have to say with respect to Meltdown and Spectre, Download ManageEngine Experts Digest and get a vendor neutral approach towards these CPU bugs.

So why are Meltdown and Spectre such a big deal?

These vulnerabilities have put computers and mobile devices using Intel processors and some AMD and ARM processors (i.e. most systems) at risk of data leaks. Luckily, operating system vendors have released patches that can help protect endpoints from both Meltdown and Spectre.

How to protect your data against Meltdown and Spectre?

The only true fix for these bugs is to replace the affected processors but this is a tall and unrealistic order for enterprises.Leading operating system vendors including Microsoft, Apple, and Google have already released updates to fix Meltdown, but Spectre has proven more difficult to patch and will continue to cause issues until further security updates are released from these vendors.

List of security updates from vendor's to these bugs

Apple

Apple has already handled this exploit in iOS 11.2.2, macOS 10.13.2, and tvOS 11.2.However Apple has not yet released an update for Safari or macOS Server.

Mozilla

Mozilla has released a security update for its browser Firefox to mitigate both Meltdown and Spectre attacks.

Linux

Linux has also already released patches for the kernel in versions 4.14.11 and 4.9.74. The complete list of versions and their updates can be found here.

Cloud vendors like VMware, AWS, Citrix, and Azure have also released fixes.

Microsoft

Microsoft was the first to respond releasing an emergency security update for Windows 10.

Note: You shouldn't install this security update if your computer is running incompatible antivirus software. Read more

Google

According to Google, mobile devices that are running the latest version of Android, released January 5th as a part of Android's January security patch, are safe from this exploit. So users with Google-branded phones running the latest version of Android safe. However, Android users on other devices will have to wait until device manufacturers roll out their own patches.

In the case of Chrome, patches for Meltdown and Spectre will be released on January 23, 2018, with Chrome 64. This update will help protect users from both desktop and mobile-based web attacks.

Trouble handling Meltdown and Spectre? We can help.

Our patch management solutions can automate security updates for you, simplifying the process of patching multiple operating systems and programs. Download either our exclusive patch management or endpoint management solution to resolve these exploits automatically.

Already using our patch management tools?

Follow the steps below to patch both Meltdown and Spectre.

Navigate to the Patch Mgmt tab.
On the bottom-left corner of the page, click Update Now under Update Vulnerability DB.
Under Views, select Scan Systems to identify missing patches in your network.
From the table of all missing patches, search for the keywords Meltdown or Spectre under Patch Description.
Select all the missing patches related to Meltdown or Spectre and click Install Patch to deploy them.
Verify their installation statuses after deployment.