ShellShock - Revision history

Lucas Trottier: /* Command line interface - TMG unit or Linux server with access to Internet (i.e. with DNS configured) */

2015-07-20T15:25:24Z

Command line interface - TMG unit or Linux server with access to Internet (i.e. with DNS configured)

2015-02-03T15:04:21Z

Moved some steps that were misplaces

2014-10-17T21:35:57Z

Typo

2014-10-17T21:33:56Z

Better formating

2014-10-17T21:32:42Z

2014-10-17T21:32:20Z

Added webportal procedure

2014-10-17T21:17:20Z

Details

2014-10-07T04:57:04Z

2014-10-07T04:56:44Z

2014-10-06T09:25:32Z

@@ Line 28: / Line 28: @@
   [root@TB011107 ~]# uname -m
   x86_64
-If the result is not "x86_64", [[Support:Contacting TelcoBridges technical support|please contact TelcoBridges]] support, otherwise you can proceed with either method below.
+If the result is not "x86_64", [[Support:Contacting TelcoBridges technical support|please contact TelcoBridges]] support, otherwise you can proceed with the method below.
 # update OS packages with yum

@@ Line 14: / Line 14: @@
 = Update procedure =
 == WebPortal - TMG unit or Linux server '''with access to Internet''' (i.e. with DNS configured) ==
@@ Line 30: / Line 26: @@
 == Command line interface - TMG unit or Linux server '''with access to Internet''' (i.e. with DNS configured) ==
 # login with root account
 # update OS packages with yum
   yum clean all

@@ Line 21: / Line 21: @@
 == WebPortal - TMG unit or Linux server '''with access to Internet''' (i.e. with DNS configured) ==
 # login onto the WebPortal
-# Select the 'host' tab
+# Select the 'Hosts' section
 # Click on the hostname
-# Click on the 'status' tab
+# Click on the 'Status' tab
 # Select 'Upgrade Linux packages' into the host 'Control Action'
 # Click on the 'Apply action' button
 == Command line interface - TMG unit or Linux server '''with access to Internet''' (i.e. with DNS configured) ==

@@ Line 20: / Line 20: @@
 == WebPortal - TMG unit or Linux server '''with access to Internet''' (i.e. with DNS configured) ==
- login onto the WebPortal
+# login onto the WebPortal
- Select the 'host' tab
+# Select the 'host' tab
- Select the hostname
+# Click on the hostname
- Click on the 'status' tab
+# Click on the 'status' tab
- Select 'Upgrade Linux packages' into the host 'Control Action'
+# Select 'Upgrade Linux packages' into the host 'Control Action'
- Click on the 'Apply action' button
+# Click on the 'Apply action' button
 == Command line interface - TMG unit or Linux server '''with access to Internet''' (i.e. with DNS configured) ==

@@ Line 26: / Line 26: @@
   Select 'Upgrade Linux packages' into the host 'Control Action'
   Click on the 'Apply action' button
 == Command line interface - TMG unit or Linux server '''with access to Internet''' (i.e. with DNS configured) ==

@@ Line 8: / Line 8: @@
 = Details =
-The impact of this vulnerability on TelcoBridges products may vary depending on the attack vector. TelcoBridges performed tests using HTTP vectors and confirm that the ShellShock vulnerability cannot be exploited against Toolpack web portal. The ShellShock might be performed throughout an SSH attack vector, which require successful authentication to be exploited and may not result in any additional privileges granted to the user.
+The impact of this vulnerability on TelcoBridges products may vary depending on the attack vector. TelcoBridges performed tests using HTTP vectors and confirm that the ShellShock vulnerability '''cannot''' be exploited against Toolpack web portal. The ShellShock might be performed throughout an SSH attack vector, which require successful authentication to be exploited and may not result in any additional privileges granted to the user.
 = Software Versions and Fixes =

@@ Line 1: / Line 1: @@
 {{DISPLAYTITLE:ShellShock : The GNU Bash Injection Vulnerability}}
-On September 24 2014, a vulnerability named "ShellShock" in the Bash shell was publicly announced. ShellShock is registered in the Common Vulnerabilities and Exposures system as ''CVE-2014-6271'' and '''CVE-2014-7169'''. The vulnerability is related to the way in which shell functions are passed though environment variables. The vulnerability may allow an attacker to inject commands into a Bash shell, depending on how the shell is invoked. The Bash shell may be invoked by a number of processes including, but not limited to, telnet, SSH, DHCP, and scripts hosted on web servers.
+On September 24 2014, a vulnerability named "ShellShock" in the Bash shell was publicly announced. ShellShock is registered in the Common Vulnerabilities and Exposures system as '''CVE-2014-6271''' and '''CVE-2014-7169'''. The vulnerability is related to the way in which shell functions are passed though environment variables. The vulnerability may allow an attacker to inject commands into a Bash shell, depending on how the shell is invoked. The Bash shell may be invoked by a number of processes including, but not limited to, telnet, SSH, DHCP, and scripts hosted on web servers.
 = Affected Products =