• Skip to primary navigation
  • Skip to main content
  • Skip to footer
ControlCase No Tag LOGO md

ControlCase

IT Certifications, Continuous Compliance and Cybersecurity Services Provider

  • Company
    • About Us
    • Careers
    • Locations
    • Team
  • Industries
    • Business Process Outsourcing
    • Cloud Service Providers
    • Retail
    • Telecom | Entertainment
  • Certifications
    • PCI DSS Certification
    • CSA STAR Certification
    • GDPR Assessment
    • HIPAA Assessment
    • HITRUST Certification
    • ISO 27001 Certification
    • FedRAMP 3PAO Services and NIST 800-53
    • CMMC Compliance: NIST 800-171
    • MARS-E Assessment
    • P2PE Certification
    • PA DSS Certification
    • SOC2 Report
  • Solutions
    • Continuous Compliance Solution
    • One Audit
    • Card Data Discovery Software
    • Data Security Rating
  • Testing
    • Application Reviews
    • Application Security Training
    • Code Reviews
    • Card Data Discovery
    • External Vulnerability Scans
    • Firewall Security Reviews
    • Internal Vulnerability Scans
    • Log Monitoring
    • Penetration Testing
  • Resources
    • Events
    • News
    • Webinars
    • Courses
    • Newsletters
    • Blog
  • Contact Us

ControlCase Advisory on the Shellshock Vulnerability

You are here: Home / Newsletters / ControlCase Advisory on the Shellshock Vulnerability
ControlCase No Tag LOGO md

ControlCase Advisory on the Shellshock Vulnerability

This is a security advisory on the “Shellshock” vulnerability.

What is Shellshock

Bourne Again Shell (bash) is a widely used shell on *NIX systems. It contains flaw that allows attacker to provide specially-crafted environment variables containing arbitrary commands that can be executed on vulnerable systems under certain conditions. So far, HTTP requests to CGI scripts have been identified as the major attack vector.The impact of exploitation of this vulnerability is as big as “Heartbleed” because of wide use of bash.

With access to bash even from the web servers using CGI, there are possibilities to create denial of service (DOS) on servers, distributed DOS (DDOS), steal data from servers and complete compromise of server/network.

Current bash versions use an environment variable named by the function name, and a function definition starting with “() {” in the variable value to propagate function definitions through the environment. The vulnerability occurs because bash does not stop after processing the function definition. it continues to parse and execute shell commands following the function definition. For example, an environment variable setting of

54223a02-3b64-497e-9a86-7b8a431875de

will execute ping command when the environment is imported into the bash process.

GNU Bash versions till 4.3 are all known to be vulnerable.

How ControlCase CaaS Customers can request test for Shellshock

ControlCase can perform Shellshock test for your infrastructure and provide you the results. ControlCase Compliance as a Service (CAAS) customer can request “Shellshock Test” by using following steps.

    1. Login to IT GRC portal
    2. Click “External PT Scan Form” link on the dashboard

cd2ddc5b-5898-4311-9f66-d37603a72d51

    1. Fill the External Network Penetration Test form with all the details and mention “Shellshock” before filling public IP addresses against #6

bb572980-8c5a-4794-8b8c-f6277f3d3660

    1. Once form is filled completely, click Notify button on top right corner

737c1035-cb85-4c78-a695-131d6153e12b

How to test if you are vulnerable

You can test your shell if it is vulnerable using following method.

f00413d6-5409-4641-9b03-168cd950792e

Upon running the above command, an affected version of bash will output “BINGO”.

If it is not vulnerable, the same test will return the following result.

f18614e4-4a7a-48b7-8dab-641f5953f26d

The above test is to only determine if you are running vulnerable version of bash.

How to fix

There is no direct patch available at the time of writing this advisory. The original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.

Workarounds

  1. If possible, you can disable access to cgi script directories available through a web interface because in a lot of cases, it may be enabled but not actually used.
  2. If cgi access is needed; if possible, restrict the usage to a list of known IPs
  3. Setup rules in your logging and monitoring solution to identify access to cgi directories and raise alerts for such access

References

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7169

http://seclists.org/oss-sec/2014/q3/650

https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/

https://blogs.akamai.com/2014/09/environment-bashing.html

About Us

ControlCase is a global provider of technology-driven compliance and security solutions. ControlCase is committed to partnering with clients to develop strategic information security and compliance programs that are simplified, cost effective and comprehensive in both on-premise and cloud environments.

ControlCase provides the best experts, customer experience and technology for regulations including PCI DSS, GDPR, SOC1, SOC2, SOC3, HIPAA/HITRUSTâ„¢, ISO 27001/2, SSAE16, PIPEDA, FERC/NERC, Sarbanes Oxley (SOX), GLBA, CoBIT, BITS FISAP and EI3PA.

https://www.controlcase.com


  • Facebook
  • LinkedIn
  • Twitter
  • YouTube

Footer

Connect

Corporate Headquarters
12015 Lee Jackson Memorial Hwy, Suite 520, Fairfax, VA 22033

Send us a message

Call Us

About Us

ControlCase is a United States based company, headquartered in Fairfax, Virginia with locations in North America, Europe, Latin America, Asia/Pacific and the Middle East to serve our clients globally.

Quick Links

  • Company
  • Team
  • Careers
  • Locations
  • Covid-19 Notice

Certifications, Assessments and Reports

  • PCI DSS Certification
  • CSA STAR Certification
  • GDPR Assessment
  • HIPAA Assessment
  • HITRUST Certification
  • ISO 27001 Certification
  • FedRAMP and 3PAO Services
  • MARS-E Assessment
  • P2PE Certification
  • PA DSS Certification
  • SOC2 Report

© ControlCase LLC 2023 | Privacy Policy | Impartiality Statement | Legal Notices