topic Re: Shell Shocked Bug in General Topics

Shell Shocked Bug

jeffdwilliams — Thu, 25 Sep 2014 20:28:17 GMT

Any update from Palo Alto on the Shell Shock Bug that has been reported?

Re: Shell Shocked Bug

ssharma — Thu, 25 Sep 2014 20:32:08 GMT

We have an update for the treat with content update 457. Make sure you are running latest one (Device -> Dynamic Updates). Threat ID 36729 and default action is set to "Alert". You can change it to drop from Objects -> Vulnerability Protection -> Exceptions (check show signatures) and search for 36729 and change the action and commit. Hope this helps. Thank you.

Re: Shell Shocked Bug

jvalentine — Thu, 25 Sep 2014 20:33:23 GMT

Yes. See this site for details regarding PAN-OS and the applicability of this bug against the firewall itself:

- Palo Alto Networks Product Vulnerability - Security Advisories

Content version 457 was released very early this morning, which addresses the firewall's ability to block these attacks:

- Version 457 Content Release Notes

Re: Shell Shocked Bug

jeffdwilliams — Fri, 26 Sep 2014 19:20:18 GMT

Thank you very much for the help.

Re: Shell Shocked Bug

ssharma — Sat, 27 Sep 2014 02:37:27 GMT

Hi Jeff,

We are glad to assist you. Thank you.

Re: Shell Shocked Bug

mmmccorkle — Tue, 30 Sep 2014 22:43:17 GMT

Jeff,

Please note the following for our new Threat DB version 458, just released.

Also note that the default action is 'Alert' not 'Drop'.

Notes: Release notes for emergency content release for CVE-2014-6271 update and CVE-2014-7169

Thursday, September 25th, Palo Alto Networks became aware of additional vulnerabilities with the Bash shell utility. The fixes for CVE-2014-6271 were incomplete from Operating System vendors and there is a new vulnerability, CVE-2014-7169, that describes this issue. To address this new vulnerability, Palo Alto Networks is releasing an emergency content update that provides updated detection of both CVE-2014-7169 and the previous CVE-2014-6271 vulnerability with an update to the IPS vulnerability Signature ID: 36729 "Bash Remote Code Execution Vulnerability" with "Critical" severity and default action of "Alert".

Don't forget to mark this discussion as answered if we have successfully addressed your issues.