Skip to main content
ECMore
ECMore
New Member
January 26, 2015
Solved

How to commit Bash.Function.Definitions.Remote.Code.Execution update?

  • January 26, 2015
  • 2 replies
  • 13428 views

Hi All,

 

I am getting all the time intrusion attack alert - Bash.Function.Definitions.Remote.Code.Execution

When I open the alert I am getting to this page:

http://www.fortiguard.com/encyclopedia/vulnerability/#id=39294

 

And I understand that I should do:

Upgrade to the latest version available from the website.

http://ftp.gnu.org/pub/gnu/bash/bash-4.3-patches/bash43-025

 

The problem is how to do this upgrade on my FortinetWifi 90D machine?

I looked every where and try to put the file but it say that this is the wrong file.

 

I tried both bash43-001.sig and  bash43-001.txt in the system-Advanced page in the CLI file update.

 

Please advise how to commit this update to the machine?

 

 

 

Thank you,

 

Eitay Cohen

 

 

    Best answer by Christopher_McMullan

    Hello Eitay,

     

    The CVE references that the FortiGuard Encyclopedia article mentions are for BASH in general. Their recommendation is correct: that you update the version of BASH present on affected devices. However, to quote from the "Shellshock FAQ" article from the Fortinet Blog (http://blog.fortinet.com/post/692:( "It is important to note that FortiOS is not affected by Shellshock. FortiOS does not use the Bash shell."

     

    What you're seeing is a detected vulnerability or attack against one of the hosts communicating through the FortiWiFi, and not the firewall itself.

     

    Your best options would be to ensure the IPS database has the most up-to-date engine and signatures available, and patch any hosts identified by these log entries.

    2 replies

    Christopher_McMullan
    Staff
    Christopher_McMullanAnswer
    Staff
    January 26, 2015

    Hello Eitay,

     

    The CVE references that the FortiGuard Encyclopedia article mentions are for BASH in general. Their recommendation is correct: that you update the version of BASH present on affected devices. However, to quote from the "Shellshock FAQ" article from the Fortinet Blog (http://blog.fortinet.com/post/692:( "It is important to note that FortiOS is not affected by Shellshock. FortiOS does not use the Bash shell."

     

    What you're seeing is a detected vulnerability or attack against one of the hosts communicating through the FortiWiFi, and not the firewall itself.

     

    Your best options would be to ensure the IPS database has the most up-to-date engine and signatures available, and patch any hosts identified by these log entries.

    ECMore
    ECMoreAuthor
    New Member
    January 26, 2015

    Hi Christopher,

     

    Thank you for your answer!

     

    What I wanted to understand is where and how do I up-to-date the engine and signatures or patches, since I don't see any place that I can do it beside system\config\Fortiguard and pressing update.

    Is there another place where I can upload .SIG files?

     

    Thanks again,

     

    Eitay COhen

    Christopher_McMullan
    Staff
    Christopher_McMullan
    Staff
    January 26, 2015

    Yes, there are two other ways you could also try:

    (1) Run 'exec update-now' from the CLI

    (2) Manually download new database files from support.fortinet.com

     

    Note that these options are only valid for signatures, not engine updates. For engine updates, you would normally have to upgrade your firmware build. However, you can also open a ticket with TAC to specifically request a new engine if the need arises.

     

    Signature updates can be obtained under Download > FortiGuard Service Updates. The list will automatically show you only the files applicable to the hardware models you have registered under your account.

    ECMore
    ECMoreAuthor
    New Member
    January 26, 2015

    OK thank you for the answer, I will try it.

     

    I already did a firmware update to 5.2.1 and it went well.

     

    Have a great day,

     

    Eitay Cohen

    Terms & ConditionsAccessibility statement