If you use BASH shell environment

[Matthew_Mollenhauer]

Just an FYI, https://access.redhat.com/security/cve/CVE-2014-6271, I wouldn' t say it' s as bad as heartbleed but it' s definitely not good. Regards, Matthew

[jtfinley]

I did create custom rules in my sensors to drop traffic matching these sigs, as the built rule default action is alert. Might want to be aware of that!

@teedub Looks like the updated sig has default action to block now. v553 Thanks for the link; all interesting stuff to read over.

[ede_pfau]

The IPS signature is called " Bash.Function.Definitions.Remote.Code.Execution" . It applies to servers and clients, OS=" Other,Linux" and is dated 2014-09-29. I found it using a filter on the modification date...

[ede_pfau]

Fortinet has released an Info page on Fortiguard.com: http://www.fortiguard.com/advisory/FG-IR-14-030/ Contains " products affected" , the use of the IPS signature on FortiGates and references. Seems there are 4 CVEs now on this topic.