PCNS 3.1 OVF10 ova..... is it vulnerable to the BASH shellshock Linux Exploit.

[Anonymous user]

Hi Guys.

IS the PCNS 3.1 OVF10 ova VA vulnerable to the BASH shellshock Linux Exploit.?

I assume it is as it is Linux based Server.

Has anyone got any ideas how to patch it if it is ?

Thanks

[BillP]

Hi Jason,

If you run "yum update" to update the appliance to use the patched version of bash.

Regards,

B

[Anonymous user]

Hi QueenB...

How to you run the update ?

[BillP · Accepted solution]

Hello Jason,

When you deploy the virtual appliance initially, you are asked to give a password for the root. You need to log in to the appliance using root as username and the password you created.

Once logged into the virtual appliance, at the root prompt type yum update. It will automatically update. Screenshot is attached below (I hope it is readable).

You can check your system after the patch update to check its vulnerability using the following command on the command line:

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

The patched system will output the following::

bash: warning: x: ignoring function definition attempt

bash: error importing function definition for `x'

this is a test

I hope this is more clear.

Regards,

B

[Anonymous user]

Hi B...

thanks for the response.

The system updated ok from the Yum update command.

But when I try the command I do not get outputted the bash warnings as above. I only get "this is a test"

Any thoughts ?

[BillP]

Hi,

Be sure to type the command exactly. Adding or removing a space will cause the command not to run properly. In the below example the first time I ran the command I added a space between x=' () and the system returned this is a test. The second time I remove the space and the system reported it was vulnerable and this is a test since I have not run yum update yet.