PatchSanctoduf的部落格

Shellshock exposes a vulnerability in Bourne Yet again Shell (Bash), the extensively-used shell for Unix-based running techniques this kind of as Linux and OS X. The bug permits the perpetrator to remotely execute commands on vulnerable ports. The vulnerability is very easy to exploit, not requiring in depth understanding of software or computational sources. The substantial functionality, along with the relative ease of launching an attack, led market analysts to label the bug a lot more critical than Heartbleed. The Nationwide Institute of Expectations and Technologies assigned the vulnerability their greatest danger score of ten.

What are the implications of ShellShock for cloud security? At Skyhigh, we reviewed organization use of in excess of 7,000 cloud service vendors for vulnerabilities. The results amazed us.

We at first expected to uncover rampant vulnerability to Shellshock amongst cloud services providers. The info portrayed a a lot more blended-bag of cloud application security.

4% of stop-user units in the enterprise surroundings make use of the susceptible edition of Bash on staff devices ��reflecting the dominance of Windows in company networks. We also discovered that only a few cloud service providers employ common gateway interface (CGI), the primary vector of attack. Whilst cloud services suppliers could be susceptible by way of other vectors (i.e. ForceCommand), the reality that they keep away from the main assault vector of the bug by means of design and architectural complexity is an indication of the maturity of present-day cloud applications.

Nonetheless, when we scanned the prime IaaS vendors(e.g. AWS, Rackspace) for the Bash vulnerability, 90% of checks noted the vulnerable Bash version on the default pictures provisione minix neo x8 android tv box. Customers ought to not hold out and rely on their IaaS companies to consider the initiative. To make sure immunity from ShellShock, all businesses ought to quickly update their techniques with the most recent version of Bash.
But remediation measures should not stop there. Presented the recent price of breaches, organizations can count on the following event is not going to be considerably off. Our recommendation: A Web Application Firewall (WAF) deployed to safeguard from pre-described assault vectors can arrive in helpful at occasions like this. Program directors can rapidly create policies for WAFs to defend from this and related bugs. In our case, we speedily updated our WAF principles in addition to updating the susceptible Bash version.

A Sample ruleset for mod_security (WAF) is as underneath:

Request Header values:
SecRule Request_HEADERS "^() {" "period:one,deny,id:1000000,t:urlDecode,standing:400,log,msg:'CVE-2014-6271 ��Bash Attack'"

SERVER_PROTOCOL values:
SecRule Ask for_LINE "() {" "phase:1,deny,id:1000001,standing:400,log,msg:'CVE-2014-6271 ��Bash Attack'"

GET/Submit names:
SecRule ARGS_NAMES "^() {" "section:two,deny,id:1000002,t:urlDecode,t:urlDecodeUni,standing:four hundred,log,msg:'CVE-2014-6271 ��Bash Attack'"

GET/Put up values:
SecRule ARGS "^() {" "phase:2,deny,id:1000003,t:urlDecode,t:urlDecodeUni,status:four hundred,log,msg:'CVE-2014-6271 ��Bash Attack'"

File names for uploads:
SecRule Documents_NAMES "^() {" "stage:2,deny,id:1000004,t:urlDecode,t:urlDecodeUni,position:four hundred,log,msg:'CVE-2014-6271 ��Bash Attack'"minix neo x8 android tv box