Shell Shocked Bug

[jeffdwilliams]

Any update from Palo Alto on the Shell Shock Bug that has been reported?

[ssharma]

We have an update for the treat with content update 457. Make sure you are running latest one (Device -> Dynamic Updates). Threat ID 36729 and default action is set to "Alert". You can change it to drop from Objects -> Vulnerability Protection -> Exceptions (check show signatures) and search for 36729 and change the action and commit. Hope this helps. Thank you.

[jvalentine]

Yes.  See this site for details regarding PAN-OS and the applicability of this bug against the firewall itself:

- Palo Alto Networks Product Vulnerability - Security Advisories

Content version 457 was released very early this morning, which addresses the firewall's ability to block these attacks:

- Version 457 Content Release Notes

[jeffdwilliams]

Thank you very much for the help.

[ssharma]

Hi Jeff,

We are glad to assist you. Thank you.

[mmmccorkle]

Jeff,

Please note the following for our new Threat DB version 458, just released.

Also note that the default action is 'Alert' not 'Drop'.

Notes: Release notes for emergency content release for CVE-2014-6271 update and CVE-2014-7169

Thursday, September 25th, Palo Alto Networks became aware of additional vulnerabilities with the Bash shell utility. The fixes for CVE-2014-6271 were incomplete from Operating System vendors and there is a new vulnerability, CVE-2014-7169, that describes this issue. To address this new vulnerability, Palo Alto Networks is releasing an emergency content update that provides updated detection of both CVE-2014-7169 and the previous CVE-2014-6271 vulnerability with an update to the IPS vulnerability Signature ID: 36729 "Bash Remote Code Execution Vulnerability" with "Critical" severity and default action of "Alert".

Don't forget to mark this discussion as answered if we have successfully addressed your issues.