Shell Shocked Bug

Announcements

ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Reply
Highlighted
L0 Member

Shell Shocked Bug

Any update from Palo Alto on the Shell Shock Bug that has been reported?

Highlighted
L5 Sessionator

We have an update for the treat with content update 457. Make sure you are running latest one (Device -> Dynamic Updates). Threat ID 36729 and default action is set to "Alert". You can change it to drop from Objects -> Vulnerability Protection -> Exceptions (check show signatures) and search for 36729 and change the action and commit. Hope this helps. Thank you.

L7 Applicator

Yes.  See this site for details regarding PAN-OS and the applicability of this bug against the firewall itself:

- Palo Alto Networks Product Vulnerability - Security Advisories

Content version 457 was released very early this morning, which addresses the firewall's ability to block these attacks:

- Version 457 Content Release Notes

Highlighted
L0 Member

Thank you very much for the help.

Highlighted
L5 Sessionator

Hi Jeff,

We are glad to assist you. Thank you.

Highlighted
L4 Transporter

Jeff,

Please note the following for our new Threat DB version 458, just released.

Also note that the default action is 'Alert' not 'Drop'.

Notes: Release notes for emergency content release for CVE-2014-6271 update and CVE-2014-7169

Thursday, September 25th, Palo Alto Networks became aware of additional vulnerabilities with the Bash shell utility. The fixes for CVE-2014-6271 were incomplete from Operating System vendors and there is a new vulnerability, CVE-2014-7169, that describes this issue. To address this new vulnerability, Palo Alto Networks is releasing an emergency content update that provides updated detection of both CVE-2014-7169 and the previous CVE-2014-6271 vulnerability with an update to the IPS vulnerability Signature ID: 36729 "Bash Remote Code Execution Vulnerability" with "Critical" severity and default action of "Alert".

Don't forget to mark this discussion as answered if we have successfully addressed your issues. :smileyhappy:

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!