Shellshocked!

What is Shellshock?

It has been widely reported in mainstream news that vulnerability dubbed Shellshock could affect 500 million devices, which over shadows the 500,000 devices that were affected by the Heartbleed vulnerability. 

Shellshock exploits a vulnerability in a command line shell used by many UNIX computers, called the Bourne Again Shell, more commonly known by its acronym Bash.  This affects computers and devices using the Linux and Mac OS, including some appliance based devices such as firewalls, which are commonly built on Linux.

Bash is a common component in webservers, but even if Linux is not being used, Apache also uses Bash.  It could also be used as a background component for web browsers, email clients and file transfer applications.

Whereas Heartbleed was a vulnerability that allowed the traffic to be sniffed, the Shellshock vulnerability allows direct access on to the vulnerable machine and with potentially three lines of code.

More technical details around the vulnerability CVE-2014-6271 aka Shellshock is linked.

What can be done?

Patch the Linux and Mac OS machines to the latest version.  There are rumours that due to the speed of patch dispatch, they may not have been QA’d as thoroughly, but it is still better than being vulnerable.

Remember that devices other than computers and servers running Linux or Mac OS can be affected.  Ensure your client software is up to date, regardless of the operating system.  With devices such as firewalls, check regularly on the vendor websites for their advice.

Here is the latest government advice on the Bash vulnerability

I’m checking the vendor sites that MTI Technology partners with and slowly creating a list of useful links here:

Aerohive:
http://www.aerohive.com/support-security-bulletins/psa-20140926-001.html

Cisco

http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_Bash_09252014.html
Cryptzone
https://support.cryptzone.com/hc/en-us/articles/201543171-Statement-regarding-Shell-Shock-Vulnerability
EMC
http://support.emc.com/kb/192608
ExtraHop
http://www.extrahop.com/post/blog/monitor-shellshock-attempts-with-extrahop/
F5
https://devcentral.f5.com/articles/cve-2014-6271-shellshocked
GTA (Global Technology Associates)
http://forum.gta.com/forum/user-community-support/firewall-general/1533-bash-shellshock-vulnerability-cve-2014-6271
Imperva
http://blog.imperva.com/2014/09/shellshock-vulnerability-cve-2014-6271.html 
Juniper
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10648
Lumension
https://www.lumension.com/kb/Home/General-Information/1666-(1).aspx
McAfee
https://kc.mcafee.com/corporate/index?page=content&id=SB10085
MobileIron
http://www.mobileiron.com/en/smartwork-blog/mobileiron-not-vulnerable-bash-exploit

Palo Alto

http://researchcenter.paloaltonetworks.com/2014/09/addressing-bash-vulnerability-shellshock-palo-alto-networks-mitigation-cve-2014-6271/

Radware
https://drive.google.com/file/d/0B0zPUWiKiUjRUmJlSnFmaEsyeW8/edit?usp=sharing
RSA
https://knowledge.rsasecurity.com/scolcms/knowledge.aspx?solution=a67980
Sophos
http://www.sophos.com/en-us/support/knowledgebase/121444.aspx
Trend Micro

http://esupport.trendmicro.com/solution/en-US/1105233.aspx
VMware
http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2090740

WatchGuard

http://watchguardsecuritycenter.com/2014/09/25/bash-or-shellshock-vulnerability/

Websense

http://www.websense.com/support/article/kbarticle/BASH-Shellshock-CVE-2014-6271
Westpoint
https://drive.google.com/file/d/0B0zPUWiKiUjRaC1zS3U4cWZrUGM/edit?usp=sharing
Xirrus
http://www.xirrus.com/blog/September-2014/Does-ShellShock-Vulnerability%E2%80%9D-impact-Xirrus-Custo

Here is the advice from some of the operating systems affected:

Apple
http://support.apple.com/kb/HT6495
CentOS
http://lists.centos.org/pipermail/centos/2014-September/146099.html
Debian
https://packages.debian.org/sid/bash
RedHat
https://access.redhat.com/solutions/1207723
Ubuntu
http://www.ubuntu.com/usn/usn-2362-1/

Last updated: 11:45 01/10/2014