- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
09-25-2014 09:21 AM
Does someone know if the PA can automatically block the bash traffic of the shellshock vulnerability? If not what would be the best rule to protect the dmz servers?
thanks
09-25-2014 09:25 AM
Default Action on the signature is set to alert. You can make an exception and change the default action and attach that vulnerability profile for DMZ traffic.
Go into your Vulnerability Protection Profile
Click "Exceptions"
Check "Show all signatures"
Enter 36729
Change the action to whatever you'd like it to be.
09-25-2014 09:26 AM
Hello
Today we get new emergency content update of threat prevention 457 that was especially made for CVE-2014-6271 with Critical severity and default action of "Alert."
SO You have to change default action for this particular ID 36729 or for whole signatures with serverity=critical to block.
My question is - is it working if I haven't SSL decryption enabled?
Regards
Slawek
09-25-2014 09:27 AM
Hi Warner,
We have an update for the treat with content update 457. Make sure you are running latest one (Device -> Dynamic Updates). Threat ID 36729 and default action is set to "Alert". You can change it to drop from Objects -> Vulnerability Protection -> Exceptions (check show signatures) and search for 36729 and change the action and commit. Hope this helps. Thank you.
09-25-2014 11:14 PM
The answer for my question is:
Product Vulnerabilities:
The Bash vulnerability currently appears to be a low severity issue as it only could be exploited by authenticated administrators. Normal PAN-OS maintenance release updates will provide a fix for the vulnerability.
Slawek
09-25-2014 11:15 PM
FYI...
Palo Alto Networks intends to release an emergency content IPS coverage for CVE-2014-7169 within the next 24 hours
Bash Shell remote code execution - CVE-2014-6271 vulnerability information
Wednesday, September 24th, Palo Alto Networks became aware of a remote code execution vulnerability in the Bash shell utility, CVE-2014-6271. The vulnerability allows for remote code execution through multiple vectors due to the way Bash is often used on linux systems for processing commands.
IPS Signature Mitigation CVE-2014-6271:
Palo Alto Networks has released an emergency content update the same day, on September 24th, that provides detection of attempted exploitation of CVE-2014-6271 with IPS vulnerability Signature ID: 36729 "Bash Remote Code Execution Vulnerability" with Critical severity and default action of "Alert." Palo Alto Networks customers with a Threat Prevention subscription are advised to verify that they are running the latest content version on their devices. If you have any questions about coverage for this advisory, please contact Support.
Product Vulnerabilities:
The Bash vulnerability currently appears to be a low severity issue as it only could be exploited by authenticated administrators. Normal PAN-OS maintenance release updates will provide a fix for the vulnerability.
We will continue to update you as additional information is available.
09-26-2014 09:16 PM
Hi Warner,
PA does not automatically block these threats. The default action for CVE-2014-6271 and CVE-2014-7169 is "alert" with the severity critical. To block these threats, follow the steps given below
(Please ensure that you have the latest content version installed. As of now, 458-2380 is the latest version. Once 458 version is installed, log out of the WebUI and log back in)
1. Go to Objects > Security Profiles > Vulnerability Protection.
2. Click Add and enter a name
3. Click the "Exceptions" tab
4. Enter the required Threat ID (36729 or 36730. Entre one threat ID at a time)
5. Check "Show all signatures" at the bottom
6. Click on "default (alert)" under the Action column
7. From the drop-down, choose the action to "drop" and click OK
8. IMPORTANT: Check the"Enable" box for the corresponding threat ID and Click OK
9. Use this Vulnerability Protection profile in the required security policy and commit the changes.
Refer the document How To Block Shellshock - CVE-2014-6271 and CVE-2014-7169
Thanks
09-27-2014 04:52 AM
Also bear in mind this is only able to look at http vulnerabilities (not the ssh) and would require a decryption policy to apply to any ssl streams.
The ssh are lower risk as you do need to have a user authenticated session in order to exploit for this method.
09-27-2014 10:37 AM
check for content version "458-2380" which was released early 9/26/2014 and it will block it. I ran TCP Replay tests in the lab and it blocked everything as long as you have critical set to "block". Also be sure once you install the new threat protection go to the CLI and run "delete admin-sessions" to log everyone off the devices. Hope this helps
09-30-2014 03:45 PM
Please note our new Threat DB just released.
Version 458.
Notes: Release notes for emergency content release for CVE-2014-6271 update and CVE-2014-7169
Thursday, September 25th, Palo Alto Networks became aware of additional vulnerabilities with the Bash shell utility. The fixes for CVE-2014-6271 were incomplete from Operating System vendors and there is a new vulnerability, CVE-2014-7169, that describes this issue. To address this new vulnerability, Palo Alto Networks is releasing an emergency content update that provides updated detection of both CVE-2014-7169 and the previous CVE-2014-6271 vulnerability with an update to the IPS vulnerability Signature ID: 36729 "Bash Remote Code Execution Vulnerability" with "Critical" severity and default action of "Alert".
Please don't forget to mark this discussion as answered if your concerns have been addressed.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!