<?xml version="1.0" encoding="UTF-8"?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en-gb">
<link rel="self" type="application/atom+xml" href="https://forum.yubico.com/feed.php?f=29&amp;t=1478" />

<title>Yubico Forum</title>
<subtitle>...visit our web-store at</subtitle>
<link href="https://forum.yubico.com/index.php" />
<updated>2014-10-01T16:12:42+01:00</updated>

<author><name><![CDATA[Yubico Forum]]></name></author>
<id>https://forum.yubico.com/feed.php?f=29&amp;t=1478</id>
<entry>
<author><name><![CDATA[GRS]]></name></author>
<updated>2014-10-01T16:12:42+01:00</updated>
<published>2014-10-01T16:12:42+01:00</published>
<id>https://forum.yubico.com/viewtopic.php?t=1478&amp;p=5611#p5611</id>
<link href="https://forum.yubico.com/viewtopic.php?t=1478&amp;p=5611#p5611"/>
<title type="html"><![CDATA[Shellshock Vulnerability Update]]></title>

<content type="html" xml:base="https://forum.yubico.com/viewtopic.php?t=1478&amp;p=5611#p5611"><![CDATA[
Recently, a vulnerability was discovered in the shell program Bash which could allow a remote attacker to execute any code he likes on the remote server.  It has a <a href="http://nvd.nist.gov/cvss.cfm?version=2&amp;name=CVE-2014-6271&amp;vector=(AV:N/AC:L/Au:N/C:C/I:C/A:C)" class="postlink"><span style="color: #0000FF">CVSS severity of 10</span></a> on a scale from 1 to 10, so it is very serious.  A vulnerable version of Bash is included with YubiRADIUS.<br /> <br />The problem is described in this link from NIST and references CVE-2014-6271 - <span style="text-decoration: underline"><span style="color: #0000FF">http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6271</span></span>.  This link also contains links to external sites where you can manually download and apply patches to fix the vulnerability in the OS used in YubiRADIUS.<br /> <br />However, you can also upgrade to <a href="http://www.greenrocketsecurity.com/greenradius/yubiradius-users" class="postlink">GreenRADIUS - Yubico Edition</a>, the next generation of YubiRADIUS. GreenRADIUS -Yubico Edition is a fully maintained open source RADIUS server built by the same team that developed YubiRADIUS.  Due to severity of the latest vulnerabilities, Green Rocket Security, <a href="http://www.yubico.com/support/partners/" class="postlink">a Yubico partner</a>, is offering a free upgrade to GreenRADIUS - Yubico Edition, which has the Shellshock fixes applied and tested, a hardened virtual appliance, and many more fixes (e.g. for the serious Heartbleed SSL vulnerability).  Find out more about GreenRADIUS - Yubico Edition <a href="http://www.greenrocketsecurity.com/greenradius/yubiradius-users" class="postlink">here</a>.<p>Statistics: Posted by <a href="https://forum.yubico.com/memberlist.php?mode=viewprofile&amp;u=2997">GRS</a> — Wed Oct 01, 2014 4:12 pm</p><hr />
]]></content>
</entry>
</feed>