Bash Vulnerability

[alb293]

http://arstechnica.com/security/2014/09/bug-in-bash-shell-creates-big-security-hole-on-anything-with-nix-in-it/

It looks like a lot of Avaya servers are vulnerable right now, since CentOS and Redhat are affected.

[jaytarbox]

And, Avaya hasn't said a word that I can find yet. I had customers asking about it only a few hours after the news broke.

[tkbinpdx]

Avaya Advisory link for 2014 - nothing posted since 9/23

https://support.avaya.com/tools/securityAdvisory?year=2014

[rbrookes]

Shellshock/Bash impact update for Avaya products
Avaya’s Product Security Team is aware of the Shellshock security issue and is working aggressively with product teams across our portfolio to assess any possible impact and identify a mitigation plan as appropriate. An Avaya Security Advisory (ASA) will be published later today, Friday 26 September at approximately 7pm ET. The Product Security team will continue to report findings as they become available.

Please visit the following link on the Avaya Support Website for the latest information on this topic. All ASAs for Shellshock will be posted to this site.

Avaya Support Website – Shellshock/Bash Impact for Avaya Products - https://support.avaya.com/helpcenter...26131554370002

[darrenspain]

hi
are avaya telling the customers to wait until they have included updates in patchs / security updates or are avaya telling customers to go ahead and use the updates from the RedHat site ?

I have read the bulletin from Avaya but it is not clear to me what is the recommended course of action ?

Thanks
Darren

[jaytarbox]

You should wait, most of the products you wouldn't have the rights to install the needed patch anyway.

[aa1]

Asa-2014-369

Take a look at this:

https://downloads.avaya.com/css/P8/documents/100183009

Arbi

[jlm]

Does anyone happen to know if this affects IP phones, and in particular the 9600 series (9608, 9611, etc.) that run a linux kernel?

I don't see this addressed on the Avaya shellshock info.

Regards,

- Joe

[richa164]

Run this test from linux shell.







env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

If you get

Vulnerable
This is a test

Well guess what !!

[audetd]

Run this test from linux shell.







env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

If you get

Vulnerable
This is a test

Well guess what !!

and now just checking my LAB's

Here is the result for the Communication Manager
dadmin@CM-LAB> env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable
this is a test

Result for my DOM0
[admin@CM2-SPDom0 ~]$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable
this is a test
[admin@CM2-SPDom0 ~]$

Result for my CDOM0
[admin@CM2-SPCdom ~]$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable
this is a test
[admin@CM2-SPCdom ~]$


So that mean i am Vulnerable.

is there an offcial procedure from Avaya to find out.

Daniel

[alb293]

Yes, if the code above does not return Vulnerable, you are fine.

[jaytarbox]

Patches out for various CM versions now, no indication if they're service interrupting or not.

[audetd]

I have installed the 6.2 patch in my Lab and the script test does not show the Vulnerable word any more.

But Platform still show it. so we will need patch later on this one.

Here is the link where i got the patch.

https://support.avaya.com/downloads/download-details.action?contentId=C2012319754487040_1&productId=P0001

[jaytarbox]

Was it service interrupting when you installed it?

[audetd]

Patches out for various CM versions now, no indication if they're service interrupting or not.

I have install on CM 6.2 Via Platform and this is HOT not service affecting

See my screen capture in attachement