ShellShock!

Judgeneo

Judgeneo

Judgeneo

Soldato
Joined
15 May 2010
Posts
10,111
Location
Out of Coventry
Security flaw effecting the whole of BASH, which is about 500m devices world wide. Bigger than heartbleed.

Working hard here to fix our estate, get busy people!

http://www.theregister.co.uk/2014/09/24/bash_shell_vuln/

Also, I know that some consumer grade routers and switches also run bash, does anyone have a manufacturer list for effected network equipment I can start checking against?
 
All ours are affected SLES 10 and up fortunately non of them are hot facing otherwise that would be 400+ servers needing to be patched
 
will it effect Cisco routers that are also DHCP servers, as far as I know DHCP servers may spawn BASH command for the backend stuff, nothing from Cisco so I assume not.

just checked out my DDWRT router, echo $SHELL and it doesnt use BASH at all .
 
Looks like my NAS would potentially be vulnerable (QNAP TS-412) but its locked away from direct internet access. The rest of my routing hardware looks to be ok.
 
looking further into Cisco stuff, if running the NX-OS which does run BASH, then it would be vulnerable to shellshock, but nothing from Cisco on what product line are effected, just the usual CVE advisory.
 
we are performing a penetration test via our 3rd party to confirm which systems are vulnerable so can get them patched asap then work thru the non internet facing servers later on this weekend
 
jfish said:
we are performing a penetration test via our 3rd party to confirm which systems are vulnerable so can get them patched asap then work thru the non internet facing servers later on this weekend
Click to expand...

Why a 3rd party, it's an easy vulnerability to test for
 
Frozennova said:
Why a 3rd party, it's an easy vulnerability to test for
Click to expand...

Its a full penetration testing that is to be done, done every month and this has been bought forward to today due to the vulnerabilty.

It has been outsourced, hence the 3rd party performing the test.

I myself have done some tests on internal appliance box that are not internet facing and the IBM Proventia IPS boxs are vulnerable (thry run Red Hat Linux)
 
jfish said:
II myself have done some tests on internal appliance box that are not internet facing and the IBM Proventia IPS boxs are vulnerable (thry run Red Hat Linux)
Click to expand...

Keep an eye on the IBM PSIRT page and also the support portal for updates, patch due on Monday (although apparently it's not really exploitable on devices).

Also note the XPU update just released which has the new decode in there, noted here.

Plus the attack is already picked up through the old Shell_Command_Injection signature which has been on devices since 2007, if you've got it enabled ;)
 
Last edited:
jfish said:
Its a full penetration testing that is to be done, done every month and this has been bought forward to today due to the vulnerabilty.

It has been outsourced, hence the 3rd party performing the test.

I myself have done some tests on internal appliance box that are not internet facing and the IBM Proventia IPS boxs are vulnerable (thry run Red Hat Linux)
Click to expand...

Interested to know if your pentest came up with anything that wasn't expected?
 
Be interested if anything was possible with the IBM GX appliance(s), as I'd been told there wasn't an exploit vector on them ;)
 
Judgeneo said:
Interested to know if your pentest came up with anything that wasn't expected?
Click to expand...

pen test came thru successfully and none of the internet facing devices were vulnerable to the exploit.

Had a few medium alerts relating to about SSL cypher warnings on web servers, but not high alerts that would have needed urgent fix.
 
Not that you'd be telling us any of the juicy bits if there were any, but if you're only really getting SSL cipher type findings it usually means they couldn't find much ;)

Although dont like it when testers fill a report with what amounts to a vulnerability scan.
 
Ev0 said:
Although dont like it when testers fill a report with what amounts to a vulnerability scan.
Click to expand...

Choose a better firm then :p


All all internet facing stuff got fixed last week, now is just cleaning up the rest of the estate. Many of the appliances need to be manually updated....
 
Judgeneo said:
Choose a better firm then :)
Click to expand...

Wasn't talking about me receiving them, more about the practice of people calling it a pen test when all they've done is run Nessus or the like ;)

Have seen it done in the past when I've been asked to look at tests companies have had commissioned, no trouble with the firms I've used in the past or the one I work for :)
 
You must log in or register to reply here.
Back
Top Bottom