3

As Cisco uses bash (and web interfaces if you haven't disable it) is it susceptible to the shell shock vulnerability?

2

Cisco will need to confirm if they are vulnerable. I expect they are not since the lack of cgi scripting exposed through the web instance for CSM/ASDM. In the meantime you can mitigate a lot of risk by restricting http/https enable to specific hosts in your network.

2

Yes, It's possible that they are vulnerable. Although they are not sure yet. Cisco believes, that devices are only vurnerable, once you're authenticated. Therefore you can only exploit the bug when you'd have admin privilege anyway.

Check the following link for more information and status updates: http://tools.cisco.com/security/center/mcontent/CiscoSecurityAdvisory/cisco-sa-20140926-bash

  • You're right- Cisco thinks authentication is required to exploit - and they are WRONG. This statement from that link: "The impact of this vulnerability on Cisco products may vary depending on the affected product because some attack vectors such as SSH, require successful authentication to be exploited..." – Lizz Oct 16 '14 at 16:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.