{"id":11606,"date":"2014-10-11T19:30:00","date_gmt":"2014-10-11T19:30:00","guid":{"rendered":"http:\/\/cloudcomputing.sys-con.com\/node\/3207925"},"modified":"2014-10-11T19:30:00","modified_gmt":"2014-10-11T19:30:00","slug":"three-ways-to-use-big-ip-asm-to-mitigate-shellshock","status":"publish","type":"post","link":"https:\/\/icloud.pe\/blog\/three-ways-to-use-big-ip-asm-to-mitigate-shellshock\/","title":{"rendered":"Three Ways to Use BIG-IP ASM to Mitigate Shellshock"},"content":{"rendered":"

UPDATE (9\/28\/2014): <\/span>Our security team indicates that we're now seeing the majority of attempted exploits of Shellshock coming in through input paramters. They've provided ASM signatures to mitigate and recommend customers use these signatures to protect their applications. You can find these signatures and more information in this post: https:\/\/devcentral.f5.com\/articles\/bash-shellshock-mitigation-using-asm-signatures<\/a> <\/span><\/p>\n

 <\/p>\n

I had a great conversation this morning with Tom Spector, Enterprise Network Engineering Lead for Security here at F5, about the ways in which customers can use BIG-IP Application Security Manager<\/a> (ASM) to mitigate Shellshock.<\/p>\n

As you're no doubt aware, the potential exploits of Shellshock continue to evolve and we're seeing both HTTP header and input fields used as a transport mechanism for this Bash vulnerability. Web application firewalls (WAF) are a well known tool for protecting applications both on inbound (request) and the outbound (response) across headers and payloads. In the case of Shellshock, BIG-IP ASM is able to provide protection regardless of whether the HTTP method is POST or GET.<\/p>\n

Tom offered the following suggestions when using ASM to mitigate Shellshock.<\/p>\n

Character Restrictions<\/h4>\n

Restrict the character ‘{‘ in HTTP headers. Unlike parentheses that are commonly used in headers the character ‘{‘ is not as commonly used (although there may be cases when it is).<\/p>\n

To do this in BIG-IP ASM:<\/p>\n