Shellshock vulnerability prevention

Reply
L0 Member

Shellshock vulnerability prevention

Does someone know if the PA can automatically block the bash traffic of the shellshock vulnerability?  If not what would be the best rule to protect the dmz servers?

thanks

L7 Applicator

Re: Shellshock vulnerability prevention

L7 Applicator

Re: Shellshock vulnerability prevention

Default Action on the signature is set to alert. You can make an exception and change the default action and attach that vulnerability profile for DMZ traffic.

Go into your Vulnerability Protection Profile

Click "Exceptions"

Check "Show all signatures"

Enter 36729

Change the action to whatever you'd like it to be.

L4 Transporter

Re: Shellshock vulnerability prevention

Hello

Today we get new emergency content update of threat prevention 457 that was especially made for CVE-2014-6271 with Critical severity and default action of "Alert."

SO You have to change default action for this particular ID 36729 or for whole signatures with serverity=critical to block.

My question is - is it working if I haven't SSL decryption enabled?

Regards

Slawek

L5 Sessionator

Re: Shellshock vulnerability prevention

Hi Warner,

We have an update for the treat with content update 457. Make sure you are running latest one (Device -> Dynamic Updates). Threat ID 36729 and default action is set to "Alert". You can change it to drop from Objects -> Vulnerability Protection -> Exceptions (check show signatures) and search for 36729 and change the action and commit. Hope this helps. Thank you.

L4 Transporter

Re: Shellshock vulnerability prevention

The answer for my question is:

Product Vulnerabilities:

The Bash vulnerability currently appears to be a low severity issue as it only could be exploited by authenticated administrators.  Normal PAN-OS maintenance release updates will provide a fix for the vulnerability.

Slawek

L7 Applicator

Re: Shellshock vulnerability prevention

FYI...

Palo Alto Networks intends to release an emergency content IPS coverage for CVE-2014-7169 within the next 24 hours

Bash Shell remote code execution - CVE-2014-6271 vulnerability information

Wednesday, September 24th, Palo Alto Networks became aware of a remote code execution vulnerability in the Bash shell utility, CVE-2014-6271. The vulnerability allows for remote code execution through multiple vectors due to the way Bash is often used on linux systems for processing commands.

IPS Signature Mitigation CVE-2014-6271:

Palo Alto Networks has released an emergency content update the same day, on September 24th, that provides detection of attempted exploitation of CVE-2014-6271 with IPS vulnerability Signature ID: 36729 "Bash Remote Code Execution Vulnerability" with Critical severity and default action of "Alert." Palo Alto Networks customers with a Threat Prevention subscription are advised to verify that they are running the latest content version on their devices. If you have any questions about coverage for this advisory, please contact Support.

Product Vulnerabilities:

The Bash vulnerability currently appears to be a low severity issue as it only could be exploited by authenticated administrators.  Normal PAN-OS maintenance release updates will provide a fix for the vulnerability.

We will continue to update you as additional information is available.

L6 Presenter

Re: Shellshock vulnerability prevention

Another update has been released today Version 458.

Highlighted
L2 Linker

Re: Shellshock vulnerability prevention

Hi Warner,

PA does not automatically block these threats. The default action for CVE-2014-6271 and CVE-2014-7169 is "alert" with the severity critical. To block these threats, follow the steps given below

(Please ensure that you have the latest content version installed. As of now, 458-2380 is the latest version. Once 458 version is installed, log out of the WebUI and log back in)

1. Go to Objects > Security Profiles > Vulnerability Protection.

2. Click Add and enter a name

3. Click the "Exceptions" tab

4. Enter the required Threat ID (36729 or 36730. Entre one threat ID at a time)

5. Check "Show all signatures" at the bottom

6. Click on "default (alert)" under the Action column

7. From the drop-down, choose the action to "drop" and click OK

8. IMPORTANT: Check the"Enable" box for the corresponding threat ID and Click OK

9. Use this Vulnerability Protection profile in the required security policy and commit the changes.

Refer the document How To Block Shellshock - CVE-2014-6271 and CVE-2014-7169

Thanks

L7 Applicator

Re: Shellshock vulnerability prevention

Also bear in mind this is only able to look at http vulnerabilities (not the ssh) and would require a decryption policy to apply to any ssl streams.

The ssh are lower risk as you do need to have a user authenticated session in order to exploit for this method.

Steve Puluka BSEET - IP Architect - DQE Communications (Metro Ethernet/ISP)
ACE PanOS 6; ACE PanOS 7; ASE 3.0; PSE 7.0 Foundations & Associate in Platform; Cyber Security; Data Center
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!