News for hackers. Stuff that matters.

A comment on Everything you need to know about the Shellshock Bash bug. Parent comment

Re:Everything you need to know about the Shellshock Bash bug by mmcclellan on Thursday September 25, 2014 @10:17AM (#8367255)
Still, publishing suggested rulesets or at least sending them over to OWASP would be Good Guy.
[ Parent | on HN ]
Re:Everything you need to know about the Shellshock Bash bug by jgrahamc on Thursday September 25, 2014 @10:20AM (#8367273)
The RedHat advisory had mod_security rules in it. Our rules are our version of that.

https://access.redhat.com/articles/1200223

    SecRule REQUEST_HEADERS: "^\(\) {" "phase:1,deny,id:1000000,t:urlDecode,status:400,log,msg:'CVE-2014-6271 - Bash Attack'"
    SecRule REQUEST_LINE "\(\) {" "phase:1,deny,id:1000001,status:400,log,msg:'CVE-2014-6271 - Bash Attack'"
    SecRule ARGS_NAMES "^\(\) {" "phase:2,deny,id:1000002,t:urlDecode,t:urlDecodeUni,status:400,log,msg:'CVE-2014-6271 - Bash Attack'"
    SecRule ARGS "^\(\) {" "phase:2,deny,id:1000003,t:urlDecode,t:urlDecodeUni,status:400,log,msg:'CVE-2014-6271 - Bash Attack'"
    SecRule FILES_NAMES "^\(\) {"  "phase:2,deny,id:1000004,t:urlDecode,t:urlDecodeUni,status:400,log,msg:'CVE-2014-6271  - Bash Attack'"
[ Parent | on HN ]