Shell Shocked Bug

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Shell Shocked Bug

L0 Member

Any update from Palo Alto on the Shell Shock Bug that has been reported?


L5 Sessionator

We have an update for the treat with content update 457. Make sure you are running latest one (Device -> Dynamic Updates). Threat ID 36729 and default action is set to "Alert". You can change it to drop from Objects -> Vulnerability Protection -> Exceptions (check show signatures) and search for 36729 and change the action and commit. Hope this helps. Thank you.

L7 Applicator

Yes.  See this site for details regarding PAN-OS and the applicability of this bug against the firewall itself:

- Palo Alto Networks Product Vulnerability - Security Advisories

Content version 457 was released very early this morning, which addresses the firewall's ability to block these attacks:

- Version 457 Content Release Notes

L0 Member

Thank you very much for the help.

Hi Jeff,

We are glad to assist you. Thank you.

L4 Transporter


Please note the following for our new Threat DB version 458, just released.

Also note that the default action is 'Alert' not 'Drop'.

Notes: Release notes for emergency content release for CVE-2014-6271 update and CVE-2014-7169

Thursday, September 25th, Palo Alto Networks became aware of additional vulnerabilities with the Bash shell utility. The fixes for CVE-2014-6271 were incomplete from Operating System vendors and there is a new vulnerability, CVE-2014-7169, that describes this issue. To address this new vulnerability, Palo Alto Networks is releasing an emergency content update that provides updated detection of both CVE-2014-7169 and the previous CVE-2014-6271 vulnerability with an update to the IPS vulnerability Signature ID: 36729 "Bash Remote Code Execution Vulnerability" with "Critical" severity and default action of "Alert".

Don't forget to mark this discussion as answered if we have successfully addressed your issues. Smiley Happy

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!