ShellShock - Revision history

Lucas Trottier: /* Command line interface - TMG unit or Linux server with access to Internet (i.e. with DNS configured) */

2015-07-20T15:25:24Z

Command line interface - TMG unit or Linux server with access to Internet (i.e. with DNS configured)

← Older revision		Revision as of 11:25, 20 July 2015
Line 28:		Line 28:
	[root@TB011107 ~]# uname -m		[root@TB011107 ~]# uname -m
	x86_64		x86_64
	If the result is not "x86_64", [[Support:Contacting TelcoBridges technical support\|please contact TelcoBridges]] support, otherwise you can proceed with ~~either~~ method below.		If the result is not "x86_64", [[Support:Contacting TelcoBridges technical support\|please contact TelcoBridges]] support, otherwise you can proceed with the method below.

	# update OS packages with yum		# update OS packages with yum

Cboulanger: Moved some steps that were misplaces

2015-02-03T15:04:21Z

Moved some steps that were misplaces

← Older revision		Revision as of 11:04, 3 February 2015
Line 14:		Line 14:

	= Update procedure =		= Update procedure =
	* login with root account
	~~[root@TB011107 ~]# uname -m~~
	~~x86_64~~
	~~If the result is not "x86_64", [[Support:Contacting TelcoBridges technical support\|please contact TelcoBridges]] support, otherwise you can proceed with either method below.~~

	== WebPortal - TMG unit or Linux server '''with access to Internet''' (i.e. with DNS configured) ==		== WebPortal - TMG unit or Linux server '''with access to Internet''' (i.e. with DNS configured) ==
Line 30:		Line 26:
	== Command line interface - TMG unit or Linux server '''with access to Internet''' (i.e. with DNS configured) ==		== Command line interface - TMG unit or Linux server '''with access to Internet''' (i.e. with DNS configured) ==
	# login with root account		# login with root account
			[root@TB011107 ~]# uname -m
			x86_64
			If the result is not "x86_64", [[Support:Contacting TelcoBridges technical support\|please contact TelcoBridges]] support, otherwise you can proceed with either method below.

	# update OS packages with yum		# update OS packages with yum
	yum clean all		yum clean all

Cboulanger: Typo

2014-10-17T21:35:57Z

Typo

← Older revision		Revision as of 17:35, 17 October 2014
Line 21:		Line 21:
	== WebPortal - TMG unit or Linux server '''with access to Internet''' (i.e. with DNS configured) ==		== WebPortal - TMG unit or Linux server '''with access to Internet''' (i.e. with DNS configured) ==
	# login onto the WebPortal		# login onto the WebPortal
	# Select the '~~host~~' ~~tab~~		# Select the 'Hosts' section
	# Click on the hostname		# Click on the hostname
	# Click on the '~~status~~' tab		# Click on the 'Status' tab
	# Select 'Upgrade Linux packages' into the host 'Control Action'		# Select 'Upgrade Linux packages' into the host 'Control Action'
	# Click on the 'Apply action' button		# Click on the 'Apply action' button
			# Repeat the process for all hosts listed

	== Command line interface - TMG unit or Linux server '''with access to Internet''' (i.e. with DNS configured) ==		== Command line interface - TMG unit or Linux server '''with access to Internet''' (i.e. with DNS configured) ==

Cboulanger: Better formating

2014-10-17T21:33:56Z

Better formating

← Older revision		Revision as of 17:33, 17 October 2014
Line 20:		Line 20:

	== WebPortal - TMG unit or Linux server '''with access to Internet''' (i.e. with DNS configured) ==		== WebPortal - TMG unit or Linux server '''with access to Internet''' (i.e. with DNS configured) ==
	login onto the WebPortal		# login onto the WebPortal
	Select the 'host' tab		# Select the 'host' tab
	~~Select~~ the hostname		# Click on the hostname
	Click on the 'status' tab		# Click on the 'status' tab
	Select 'Upgrade Linux packages' into the host 'Control Action'		# Select 'Upgrade Linux packages' into the host 'Control Action'
	Click on the 'Apply action' button		# Click on the 'Apply action' button

	== Command line interface - TMG unit or Linux server '''with access to Internet''' (i.e. with DNS configured) ==		== Command line interface - TMG unit or Linux server '''with access to Internet''' (i.e. with DNS configured) ==

Cboulanger at 21:32, 17 October 2014

2014-10-17T21:32:42Z

← Older revision		Revision as of 17:32, 17 October 2014
Line 26:		Line 26:
	Select 'Upgrade Linux packages' into the host 'Control Action'		Select 'Upgrade Linux packages' into the host 'Control Action'
	Click on the 'Apply action' button		Click on the 'Apply action' button


	== Command line interface - TMG unit or Linux server '''with access to Internet''' (i.e. with DNS configured) ==		== Command line interface - TMG unit or Linux server '''with access to Internet''' (i.e. with DNS configured) ==

Cboulanger: Added webportal procedure

2014-10-17T21:32:20Z

Added webportal procedure

← Older revision		Revision as of 17:32, 17 October 2014
Line 19:		Line 19:
	If the result is not "x86_64", [[Support:Contacting TelcoBridges technical support\|please contact TelcoBridges]] support, otherwise you can proceed with either method below.		If the result is not "x86_64", [[Support:Contacting TelcoBridges technical support\|please contact TelcoBridges]] support, otherwise you can proceed with either method below.

	== TMG unit or Linux server '''with access to Internet''' (i.e. with DNS configured) ==		== WebPortal - TMG unit or Linux server '''with access to Internet''' (i.e. with DNS configured) ==
			login onto the WebPortal
			Select the 'host' tab
			Select the hostname
			Click on the 'status' tab
			Select 'Upgrade Linux packages' into the host 'Control Action'
			Click on the 'Apply action' button


			== Command line interface - TMG unit or Linux server '''with access to Internet''' (i.e. with DNS configured) ==
	# login with root account		# login with root account
	# update OS packages with yum		# update OS packages with yum

Cboulanger: /* Details */

2014-10-17T21:17:20Z

Details

← Older revision		Revision as of 17:17, 17 October 2014
Line 8:		Line 8:

	= Details =		= Details =
	The impact of this vulnerability on TelcoBridges products may vary depending on the attack vector. TelcoBridges performed tests using HTTP vectors and confirm that the ShellShock vulnerability cannot be exploited against Toolpack web portal. The ShellShock might be performed throughout an SSH attack vector, which require successful authentication to be exploited and may not result in any additional privileges granted to the user.		The impact of this vulnerability on TelcoBridges products may vary depending on the attack vector. TelcoBridges performed tests using HTTP vectors and confirm that the ShellShock vulnerability '''cannot''' be exploited against Toolpack web portal. The ShellShock might be performed throughout an SSH attack vector, which require successful authentication to be exploited and may not result in any additional privileges granted to the user.

	= Software Versions and Fixes =		= Software Versions and Fixes =

Lucas Trottier at 04:57, 7 October 2014

2014-10-07T04:57:04Z

← Older revision		Revision as of 00:57, 7 October 2014
Line 1:		Line 1:
	{{DISPLAYTITLE:ShellShock : The GNU Bash Injection Vulnerability}}		{{DISPLAYTITLE:ShellShock : The GNU Bash Injection Vulnerability}}

	On September 24 2014, a vulnerability named "ShellShock" in the Bash shell was publicly announced. ShellShock is registered in the Common Vulnerabilities and Exposures system as ''CVE-2014-6271'' and '''CVE-2014-7169'''. The vulnerability is related to the way in which shell functions are passed though environment variables. The vulnerability may allow an attacker to inject commands into a Bash shell, depending on how the shell is invoked. The Bash shell may be invoked by a number of processes including, but not limited to, telnet, SSH, DHCP, and scripts hosted on web servers.		On September 24 2014, a vulnerability named "ShellShock" in the Bash shell was publicly announced. ShellShock is registered in the Common Vulnerabilities and Exposures system as '''CVE-2014-6271''' and '''CVE-2014-7169'''. The vulnerability is related to the way in which shell functions are passed though environment variables. The vulnerability may allow an attacker to inject commands into a Bash shell, depending on how the shell is invoked. The Bash shell may be invoked by a number of processes including, but not limited to, telnet, SSH, DHCP, and scripts hosted on web servers.

	= Affected Products =		= Affected Products =

Lucas Trottier at 04:56, 7 October 2014

2014-10-07T04:56:44Z

← Older revision		Revision as of 00:56, 7 October 2014
Line 1:		Line 1:
	{{DISPLAYTITLE:ShellShock : The GNU Bash Injection Vulnerability}}		{{DISPLAYTITLE:ShellShock : The GNU Bash Injection Vulnerability}}

	On September 24, 2014, a vulnerability named "ShellShock" in the Bash shell was publicly announced on the ~~US National Vulnerability Database ('~~''CVE-2014-6271''' and '''CVE-2014-7169'''). The vulnerability is related to the way in which shell functions are passed though environment variables. The vulnerability may allow an attacker to inject commands into a Bash shell, depending on how the shell is invoked. The Bash shell may be invoked by a number of processes including, but not limited to, telnet, SSH, DHCP, and scripts hosted on web servers.		On September 24 2014, a vulnerability named "ShellShock" in the Bash shell was publicly announced. ShellShock is registered in the Common Vulnerabilities and Exposures system as ''CVE-2014-6271'' and '''CVE-2014-7169'''. The vulnerability is related to the way in which shell functions are passed though environment variables. The vulnerability may allow an attacker to inject commands into a Bash shell, depending on how the shell is invoked. The Bash shell may be invoked by a number of processes including, but not limited to, telnet, SSH, DHCP, and scripts hosted on web servers.

	= Affected Products =		= Affected Products =

Lucas Trottier at 09:25, 6 October 2014

2014-10-06T09:25:32Z

← Older revision		Revision as of 05:25, 6 October 2014
Line 1:		Line 1:
	{{DISPLAYTITLE:ShellShock : The GNU Bash Injection Vulnerability}}		{{DISPLAYTITLE:ShellShock : The GNU Bash Injection Vulnerability}}

	On September 24, 2014, a vulnerability named "ShellShock" in the Bash shell was publicly announced on the US National Vulnerability Database (CVE-2014-6271 and CVE-2014-7169). The vulnerability is related to the way in which shell functions are passed though environment variables. The vulnerability may allow an attacker to inject commands into a Bash shell, depending on how the shell is invoked. The Bash shell may be invoked by a number of processes including, but not limited to, telnet, SSH, DHCP, and scripts hosted on web servers.		On September 24, 2014, a vulnerability named "ShellShock" in the Bash shell was publicly announced on the US National Vulnerability Database ('''CVE-2014-6271''' and '''CVE-2014-7169'''). The vulnerability is related to the way in which shell functions are passed though environment variables. The vulnerability may allow an attacker to inject commands into a Bash shell, depending on how the shell is invoked. The Bash shell may be invoked by a number of processes including, but not limited to, telnet, SSH, DHCP, and scripts hosted on web servers.

	= Affected Products =		= Affected Products =