Bash Shellshock Vulnerability And PCI Compliance

Home » Our Blogs » Hosting Tips ~n~ Tricks » Bash Shellshock Vulnerability And PCI Compliance

We were alerted by both Liquidweb, Inc. & William Rock of a critical vulnerability flaw made public just hours ago. We turned off all access to shell. Halted all access to SCP/SFTP and recommend FTPES.  We employ TLS 1.1 for Explicit FTP. This method allows your router to broadcast the external IP address (ISP telephone number to your computer) rather than the internal IP address that often happens with FTPS. We do not allow default FTP because it sends your password in the clear and over an insecure connection.

All accounts are safe and secure. All servers were scanned for changes. Our root level activity log prevents tampering. You can rest well, tonight. You are safe from the Shellshock bug. We’ve added a filtering signature to our Intrusion detection software to check packets as they arrive for possible attempt to gain access and block the IP at the Firewall.

If you still feel uneasy, we’re here….

By |2016-11-04T07:25:33+00:00September 25th, 2014|Categories: Hosting Tips ~n~ Tricks|0 Comments

About the Author:

Over a decade of experience in open source e-commerce shopping carts. A certified Linux Administrator and the hostmaster for StrikeHawk eCommerce, Inc.

Comments

Loading Facebook Comments ...
Loading Disqus Comments ...