Bash Vulnerability

[alb293]

http://arstechnica.com/security/2014...ith-nix-in-it/

It looks like a lot of Avaya servers are vulnerable right now, since CentOS and Redhat are affected.

[jaytarbox]

And, Avaya hasn't said a word that I can find yet. I had customers asking about it only a few hours after the news broke.

[tkbinpdx]

https://support.avaya.com/tools/secu...sory?year=2014

[rbrookes]

Shellshock/Bash impact update for Avaya products
Avaya’s Product Security Team is aware of the Shellshock security issue and is working aggressively with product teams across our portfolio to assess any possible impact and identify a mitigation plan as appropriate. An Avaya Security Advisory (ASA) will be published later today, Friday 26 September at approximately 7pm ET. The Product Security team will continue to report findings as they become available.

Please visit the following link on the Avaya Support Website for the latest information on this topic. All ASAs for Shellshock will be posted to this site.

Avaya Support Website – Shellshock/Bash Impact for Avaya Products - https://support.avaya.com/helpcenter...26131554370002

[darrenspain]

hi
are avaya telling the customers to wait until they have included updates in patchs / security updates or are avaya telling customers to go ahead and use the updates from the RedHat site ?

I have read the bulletin from Avaya but it is not clear to me what is the recommended course of action ?

Thanks
Darren

[jaytarbox]

You should wait, most of the products you wouldn't have the rights to install the needed patch anyway.

[aa1]

Take a look at this:

https://downloads.avaya.com/css/P8/documents/100183009

Arbi

[jlm]

Does anyone happen to know if this affects IP phones, and in particular the 9600 series (9608, 9611, etc.) that run a linux kernel?

I don't see this addressed on the Avaya shellshock info.

Regards,

- Joe

[richa164]

Run this test from linux shell.







env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

If you get

Vulnerable
This is a test

Well guess what !!

[audetd]

Originally Posted by richa164

Run this test from linux shell.







env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

If you get

Vulnerable
This is a test

Well guess what !!

and now just checking my LAB's

Here is the result for the Communication Manager
dadmin@CM-LAB> env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable
this is a test

Result for my DOM0
[admin@CM2-SPDom0 ~]$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable
this is a test
[admin@CM2-SPDom0 ~]$

Result for my CDOM0
[admin@CM2-SPCdom ~]$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable
this is a test
[admin@CM2-SPCdom ~]$


So that mean i am Vulnerable.

is there an offcial procedure from Avaya to find out.

Daniel