This was fixed in a new patch a few hours ago.
For those with MOL access you can find the latest update here.
http://domino1.mitel.com/ProdSupp/prodsupkb.nsf/ByProduct/611D18460FF313BA85257D65006C6547?opendocument&loginFor those that don't, here is the update:
Article ID #
14-1263-00115 Article Type
Technical Bulletin
Article Title
#2014-1004-04 - MBG Remediation Plan - Remote Code Execution Vulnerability in BASH Interpreter - Publish Date
Oct-2-2014
Body/Solutions
MBG Servicelink Update for ShellShock Bug
This service link eliminates a publicly-known defect in the BASH interpreter that affects MiVoice Border Gateway (MBG) and can potentially lead to a security vulnerability. This bug is widely known as “Shellshock.”
About the BASH Defect
The ShellShock bug is a group of serious vulnerabilities in the popular BASH shell interpreter. It is also widespread, existing in most Linux-based products. Since the initial vulnerability was first announced and patched, new aspects of the vulnerability have been discovered. This servicelink update eliminates all currently-known vulnerabilities in BASH related to ShellShock. These are being
tracked as:
• CVE-2014-6271,
• CVE-2014-7169,
• CVE-2014-7186,
• CVE-2014-7187,
• CVE-2014-6277, and
• CVE-2014-6278.
The flaw involves improper processing of environment variables. In certain configurations, the ShellShock vulnerability may allow an unauthenticated remote attacker to execute malicious code on a targeted system. Of particular concern are services that receive a request via HTTP and use BASH to execute commands on the server. In some configurations, this vulnerability could be used to install malware on a server. Independent reports indicate that vulnerable systems are being targeted and compromised for use in botnets.
Risk to MiVoice Border Gateway Systems
ShellShock is rated as a serious vulnerability, but the actual risk varies from system to system. In most deployments of the MBG, the risk is relatively small. Two of the most common ways of exploiting the ShellShock vulnerability is through CGI programs on a web server or via a poorly secured SSH server. However, Mitel normally recommends that the SSH server be disabled by default and most MBGs have no CGI scripts. The exceptions to this are MBGs configured to support YA clients or secure call recording. Even in these configurations, these CGI scripts are unlikely to be known to the malicious scanning engines that are the most prevalent threats “in the wild.”
Nonetheless, Mitel strongly recommends that all customers install the servicelink update to correct the defect. Mitel continues to monitor the situation around the ShellShock bug.
Remediation Plan for Stand Alone Mitel Border Gateway Systems
Mitel Border Gateway Version 8.1
An updated version of the Mitel Standard Linux has been released via AMC to allow for systems to pick up the ShellShock fix. For both physical and virtual servers, please open the blades panel in server-manager, select update list and click upgrade beside the 10.1.0.31 service link load.
As with all upgrades, make a backup of the system before proceeding, and another is recommended following the update.
Any new install must be running 10.1.31.0 or AMC may fail to download license keys.
Mitel Border Gateway Version 8.0
An updated version of the Mitel Standard Linux has been released via AMC to allow for systems to pick up the ShellShock fix.
Physical systems may access the blades panel in server-manager, and execute the servicelink upgrade to 10.0.51.0.
It is recommended to then upgrade MBG to the latest 8.0 blade.
Virtual systems must redeploy the MBG ova file, using 8.0.26.0, and restore the database. Then upgrade the servicelink via the blades panel to 10.0.51.0, and then MBG to 8.0.27.0.
Alternatively, if SWA is active, deploying 8.1.13.0, restoring the db and upgrading servicelink to 10.1.31.0 is also an option.
As with all upgrades, make a backup before proceeding, and a second backup following the upgrade is recommended.
Mitel Border Gateway Version 7.1
An updated version of the Mitel Standard Linux has been released via AMC to allow for systems to pick up the ShellShock fix.
For both physical and virtual servers, please open the blades panel in server-manager, select update list and click upgrade beside the 9.4.39.0 service link load.
As with all upgrades, make a backup of the system before proceeding, and another is recommended following the update
Mitel Border Gateway Version 7.0
An updated version of the Mitel Standard Linux has been released via AMC to allow for systems to pick up the ShellShock fix.
For both physical and virtual servers, please open the blades panel in server-manager, select update list and click upgrade beside the 9.3.31.0 service link.
As with all upgrades, make a backup of the system before proceeding, and another is recommended following the update
