Article ID: 000080885 Content Type: Install & Setup Last Reviewed: 07/09/2014

Do I need to take any action to mitigate the Heartbleed vulnerability of browsers using OpenSSL when using the Quartus II software?

Environment

    Quartus® II Subscription Edition
BUILT IN - ARTICLE INTRO SECOND COMPONENT
Description

There is no indication that the Quartus® II design software tools have been exploited using the Heartbleed vulnerability of browsers using OpenSSL.

However the security of your Quartus II design information data is taken very seriously by Altera®.

Resolution

On the Linux operating systems, the Quartus II software makes use of the OpenSSL library installed on your host for the Notification Center feature released in Quartus II version 13.0.  Altera recommends upgrading your Linux operating system libraries to patch the necessary OpenSSL packages. This will immediately close the vulnerability for all applications, including the Quartus II software, on your computer.

On the Windows operating system, Altera shipped the OpenSSL library version 1.0.1c in the  Quartus II software versions 13.0 and 13.1, which contains the Heartbleed vulnerability.  The Quartus II software does not run a web server using secure sockets layer (SSL), and so it is not possible to exploit the vulnerability of Heartbleed directly.  However, it is possible a third party could conceivably steal sensitive data the graphical user interface (GUI) or quartus_sh, such as compilation reports, if you have Notification Center enabled. 

Altera recommends you download and install the patch from the link below. You must install or have installed the Quartus II software version 13.0, 13.0 SP1 or 13.1 before installing this patch.

Future versions of the Quartus II software for Windows operating systems will ship with the patched version 1.0.1g of OpenSSL that addresses the Heartbleed vulnerability.

Related Products

This article applies to 1 products

Intel® Programmable Devices

1