Shellshock vulnerability prevention

[warner]

Does someone know if the PA can automatically block the bash traffic of the shellshock vulnerability?  If not what would be the best rule to protect the dmz servers?

thanks

[HULK]

Is Palo vulnerable to the shell shock Linux bug?

[HULK]

Default Action on the signature is set to alert. You can make an exception and change the default action and attach that vulnerability profile for DMZ traffic.

Go into your Vulnerability Protection Profile

Click "Exceptions"

Check "Show all signatures"

Enter 36729

Change the action to whatever you'd like it to be.

[_slv_]

Hello

Today we get new emergency content update of threat prevention 457 that was especially made for CVE-2014-6271 with Critical severity and default action of "Alert."

SO You have to change default action for this particular ID 36729 or for whole signatures with serverity=critical to block.

My question is - is it working if I haven't SSL decryption enabled?

Regards

Slawek

[ssharma]

Hi Warner,

We have an update for the treat with content update 457. Make sure you are running latest one (Device -> Dynamic Updates). Threat ID 36729 and default action is set to "Alert". You can change it to drop from Objects -> Vulnerability Protection -> Exceptions (check show signatures) and search for 36729 and change the action and commit. Hope this helps. Thank you.

[_slv_]

The answer for my question is:

Product Vulnerabilities:

The Bash vulnerability currently appears to be a low severity issue as it only could be exploited by authenticated administrators.  Normal PAN-OS maintenance release updates will provide a fix for the vulnerability.

Slawek

[HULK]

FYI...

Palo Alto Networks intends to release an emergency content IPS coverage for CVE-2014-7169 within the next 24 hours

Bash Shell remote code execution - CVE-2014-6271 vulnerability information

Wednesday, September 24th, Palo Alto Networks became aware of a remote code execution vulnerability in the Bash shell utility, CVE-2014-6271. The vulnerability allows for remote code execution through multiple vectors due to the way Bash is often used on linux systems for processing commands.

IPS Signature Mitigation CVE-2014-6271:

Palo Alto Networks has released an emergency content update the same day, on September 24th, that provides detection of attempted exploitation of CVE-2014-6271 with IPS vulnerability Signature ID: 36729 "Bash Remote Code Execution Vulnerability" with Critical severity and default action of "Alert." Palo Alto Networks customers with a Threat Prevention subscription are advised to verify that they are running the latest content version on their devices. If you have any questions about coverage for this advisory, please contact Support.

Product Vulnerabilities:

The Bash vulnerability currently appears to be a low severity issue as it only could be exploited by authenticated administrators.  Normal PAN-OS maintenance release updates will provide a fix for the vulnerability.

We will continue to update you as additional information is available.

[panos]

Another update has been released today Version 458.

[gchandrasekaran]

Hi Warner,

PA does not automatically block these threats. The default action for CVE-2014-6271 and CVE-2014-7169 is "alert" with the severity critical. To block these threats, follow the steps given below

(Please ensure that you have the latest content version installed. As of now, 458-2380 is the latest version. Once 458 version is installed, log out of the WebUI and log back in)

1. Go to Objects > Security Profiles > Vulnerability Protection.

2. Click Add and enter a name

3. Click the "Exceptions" tab

4. Enter the required Threat ID (36729 or 36730. Entre one threat ID at a time)

5. Check "Show all signatures" at the bottom

6. Click on "default (alert)" under the Action column

7. From the drop-down, choose the action to "drop" and click OK

8. IMPORTANT: Check the"Enable" box for the corresponding threat ID and Click OK

9. Use this Vulnerability Protection profile in the required security policy and commit the changes.

Refer the document How To Block Shellshock - CVE-2014-6271 and CVE-2014-7169

Thanks

[pulukas]

Also bear in mind this is only able to look at http vulnerabilities (not the ssh) and would require a decryption policy to apply to any ssl streams.

The ssh are lower risk as you do need to have a user authenticated session in order to exploit for this method.

[jperry1]

warner

check for content version "458-2380" which was released early 9/26/2014 and it will block it. I ran TCP Replay tests in the lab and it blocked everything as long as you have critical set to "block". Also be sure once you install the new threat protection go to the CLI and run "delete admin-sessions" to log everyone off the devices. Hope this helps

[mmmccorkle]

Please note our new Threat DB just released.

Version 458.

Notes: Release notes for emergency content release for CVE-2014-6271 update and CVE-2014-7169

Thursday, September 25th, Palo Alto Networks became aware of additional vulnerabilities with the Bash shell utility. The fixes for CVE-2014-6271 were incomplete from Operating System vendors and there is a new vulnerability, CVE-2014-7169, that describes this issue. To address this new vulnerability, Palo Alto Networks is releasing an emergency content update that provides updated detection of both CVE-2014-7169 and the previous CVE-2014-6271 vulnerability with an update to the IPS vulnerability Signature ID: 36729 "Bash Remote Code Execution Vulnerability" with "Critical" severity and default action of "Alert".

Please don't forget to mark this discussion as answered if your concerns have been addressed.