Bash Vulnerability

[alb293]

http://arstechnica.com/security/2014...ith-nix-in-it/

It looks like a lot of Avaya servers are vulnerable right now, since CentOS and Redhat are affected.

[jaytarbox]

And, Avaya hasn't said a word that I can find yet. I had customers asking about it only a few hours after the news broke.

[tkbinpdx]

https://support.avaya.com/tools/secu...sory?year=2014

[rbrookes]

Shellshock/Bash impact update for Avaya products
Avaya’s Product Security Team is aware of the Shellshock security issue and is working aggressively with product teams across our portfolio to assess any possible impact and identify a mitigation plan as appropriate. An Avaya Security Advisory (ASA) will be published later today, Friday 26 September at approximately 7pm ET. The Product Security team will continue to report findings as they become available.

Please visit the following link on the Avaya Support Website for the latest information on this topic. All ASAs for Shellshock will be posted to this site.

Avaya Support Website – Shellshock/Bash Impact for Avaya Products - https://support.avaya.com/helpcenter...26131554370002

[darrenspain]

hi
are avaya telling the customers to wait until they have included updates in patchs / security updates or are avaya telling customers to go ahead and use the updates from the RedHat site ?

I have read the bulletin from Avaya but it is not clear to me what is the recommended course of action ?

Thanks
Darren

[jaytarbox]

You should wait, most of the products you wouldn't have the rights to install the needed patch anyway.