Centreon customers are not affected. Reported campaign concerns an obsolete open source version of the software for which users did not follow ANSSI’s cybersecurity hygiene recommendations.
Paris & Toronto, Tuesday, February 16, 2021 – Centreon, a trusted partner for IT operational excellence, provides clarification following the publication of ANSSI’s report CERTFR-2021-CTI-004.
The report was published yesterday, February 15, on a suspected security vulnerability in the Centreon monitoring software platform. This report could mislead individuals to believe that the solutions provided by Centreon would present security flaws.
This Centreon press release clarifies the facts in light of current knowledge concerning the identified campaign and its exchanges with the ANSSI. In addition, Centreon calls on companies and public organizations to respect the ANSSI IT Health Recommendations and to preferably use updated and supported versions of its solutions.
Centreon would like to provide important details:
- IMPORTANCE OF FOLLOWING IT SECURITY RECOMMENDATIONS
The campaign described by ANSSI exclusively concerns obsolete versions of Centreon’s open source software. Indeed, the ANSSI specifies that the most recent version concerned by this campaign is version 2.5.2, released in November 2014. This version is not only no longer supported for more than 5 years, but has apparently also been deployed without respect for the security of servers and networks, including connections outside the entities concerned. Since this version, Centreon has released 8 major versions. Centreon recalls the importance of complying with ANSSI IT Health guidelines and recommendations for installing and securing software.
- NO CUSTOMERS IMPACTED
It is confirmed by ANSSI that no Centreon customers were impacted. According to discussions over the past 24 hours with ANSSI, only about fifteen entities were the target of this campaign, and that they are all users of an obsolete open source version (v2.5.2), which has been unsupported for 5 years. Centreon is currently contacting all of its customers and partners to assist them in verifying their installations are current and complying with ANSSI’s guidelines for a Healthy Information System.
- NO PROPAGATION OF MALICIOUS CODE
The ANSSI report and our exchanges with them confirm that Centreon did not distribute or contribute to propagate malicious code. This is not a supply chain type attack and no parallel with other attacks of this type can be made in this case.
- CAMPAIGN COMPLETED
In addition, ANSSI specifies that the campaign in question is over and that no malicious activity can be observed at this time.
- RECOMMENDATION
Centreon recommends that all users who still have an obsolete version of its open source software in production update it to the latest version or contact Centreon and its network of certified partners.
About Centreon
Centreon is a global provider of business-aware IT monitoring for always-on operations and performance excellence. The company’s AIOps-ready, business-aware IT monitoring platform is renowned for its unique ability to monitor today’s complex and converging infrastructures, from Cloud-to-Edge. Privately held, Centreon was founded in 2005 with roots in open source software. The company continues to steward a dynamic open source framework and a growing, vibrant global community of 200,000. Today, Centreon is trusted by organizations of all sizes across a wide range of public and private sectors. Its head offices are located in Paris and Toronto, with sales offices in Geneva, Luxembourg and Toulouse.
For more information, visit www.centreon.com.
Share
