How to commit Bash.Function.Definitions.Remote.Code.Execution update?

[EC]

Hi All,

I am getting all the time intrusion attack alert - Bash.Function.Definitions.Remote.Code.Execution

When I open the alert I am getting to this page:

http://www.fortiguard.com/encyclopedia/vulnerability/#id=39294

And I understand that I should do:

Upgrade to the latest version available from the website.

http://ftp.gnu.org/pub/gnu/bash/bash-4.3-patches/bash43-025

The problem is how to do this upgrade on my FortinetWifi 90D machine?

I looked every where and try to put the file but it say that this is the wrong file.

I tried both bash43-001.sig and  bash43-001.txt in the system-Advanced page in the CLI file update.

Please advise how to commit this update to the machine?

Thank you,

Eitay Cohen

[Christopher_McMullan · Accepted solution]

Hello Eitay,

The CVE references that the FortiGuard Encyclopedia article mentions are for BASH in general. Their recommendation is correct: that you update the version of BASH present on affected devices. However, to quote from the "Shellshock FAQ" article from the Fortinet Blog (http://blog.fortinet.com/post/692:( "It is important to note that FortiOS is not affected by Shellshock. FortiOS does not use the Bash shell."

What you're seeing is a detected vulnerability or attack against one of the hosts communicating through the FortiWiFi, and not the firewall itself.

Your best options would be to ensure the IPS database has the most up-to-date engine and signatures available, and patch any hosts identified by these log entries.

[Christopher_McMullan · Accepted solution]

Hello Eitay,

The CVE references that the FortiGuard Encyclopedia article mentions are for BASH in general. Their recommendation is correct: that you update the version of BASH present on affected devices. However, to quote from the "Shellshock FAQ" article from the Fortinet Blog (http://blog.fortinet.com/post/692:( "It is important to note that FortiOS is not affected by Shellshock. FortiOS does not use the Bash shell."

What you're seeing is a detected vulnerability or attack against one of the hosts communicating through the FortiWiFi, and not the firewall itself.

Your best options would be to ensure the IPS database has the most up-to-date engine and signatures available, and patch any hosts identified by these log entries.

[EC]

Hi Christopher,

Thank you for your answer!

What I wanted to understand is where and how do I up-to-date the engine and signatures or patches, since I don't see any place that I can do it beside system\config\Fortiguard and pressing update.

Is there another place where I can upload .SIG files?

Thanks again,

Eitay COhen

[Christopher_McMullan · Accepted solution]

Yes, there are two other ways you could also try:

(1) Run 'exec update-now' from the CLI

(2) Manually download new database files from support.fortinet.com

Note that these options are only valid for signatures, not engine updates. For engine updates, you would normally have to upgrade your firmware build. However, you can also open a ticket with TAC to specifically request a new engine if the need arises.

Signature updates can be obtained under Download > FortiGuard Service Updates. The list will automatically show you only the files applicable to the hardware models you have registered under your account.

[EC]

OK thank you for the answer, I will try it.

I already did a firmware update to 5.2.1 and it went well.

Have a great day,

Eitay Cohen