A killer vulnerability KILLS AGAIN!!! Another "branded vulnerability" – Shellshock – is heeeeere! Run for the hills, escape the planet, switch to a "secure OS" (Windows 3.1 fits the bill), stop the cyber, etc, etc, etc.
However, this post is not about Shellshock with a "perfect 10.0" in CVSS Base – at least not directly.
Sure, if you have not patched yet – stop reading this now. Deploy a patch to bash – focus the remediation on the Internet-visible servers first (some of our clients set a reasonable 1 hour patching timeline for this one – as in "patch all exposed systems within 1 hour of patch release." Eat this, folks that take 90 days to patch!). Scan your servers for the vulnerability to know how exposed you are (if at all), and do not limit the scanning to the Internet-visible sites since having this issue on the internal servers makes the attacker's job easier. Note that an authenticated scan will show that you are vulnerable on all Unix/Linux servers, but will NOT show where you are exploitable, while an unauthenticated scan will not show all the exploitation avenues (a great case study for the limits of modern VA technology). Some people have temporarily changed shells (tcsh is still alive!), thus breaking many scripts, and deployed NIPS and WAF rules tactically. Do all that, sure. Others have used this as an opportunity to remove the – frankly, idiotic! – shell scripts from public /cgi-bin directories and do other tightening of their infrastructure.
All in all, I think Shellshock is not even in the ballpark of Heartbleed (others disagree): with that baby, pretty much the entire SSL-using Internet was vulnerable and exploitable. Here with Shellshock we have a relatively small population of remotely exploitable systems (early evidence pointed at exploitable sites numbering in thousands, not millions). Sure, the impact (easy remote access by an attacker) is worse, but much fewer sites are exploitable.
In any case, WHY IS THIS NEWS TO SOME PEOPLE NOW IN 2014?!!
So, as a reminder for most and as news for some: do not make your security architecture solely reliant on patching. Big vulnerabilities will happen and so will zero-days, so make sure that your entire security architecture does not crumble if there is one critical vulnerability: do defense in depth, layers, "least privilege", controls not reliant on updates, monitoring, deception, etc. The fact that they have a 10.0 remote should NOT mean that you automatically lose everything!!
Thoughts on Critical Vulnerability Kills Again!!!
with the Swann MP3 DJ Doorbell ($49. It's easy to tell some apps were rushed out the door in order to arrive on day one.
return it and get your money back, no questions asked.
to get an accurate and reliable measurement. Tanita bathroom scales are extremely good in achieving the following purpose.