Shellshock mitigation with BIG-IP iRules

Yesterday, NIST released information on a new network exploitable vulnerability in the GNU Bash shell as demonstrated by vectors involving parts of OpenSSH sshd, the mod_cgi, and mod_cgid modules in ...
Updated Jun 06, 2023
Version 2.0
application delivery
devops
iRules
security
shellshock
brad_11480's avatar
brad_11480
Icon for Nimbostratus rankNimbostratus
Sep 30, 2014
as Gary noted, the pattern *(*)*\{* would end up with many false positives. User agents, as stated, would be enclosed in parenthesis and then anything following it that uses a left curly brace would trigger. Example: User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900T Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.117 Mobile Safari/537.36 Accept-Encoding: gzip,deflate Accept-Language: en-US,en;q=0.8 Cookie: _gat=1; MM_GUID=1ffa80b5-007f-8d02-fbe5-1c15bd314e65; MM_UUID=EEFC18F2-A109-434E-A7C6-5E4F0F400A3D; MM_DP={"bmi":"","gclid":"CIuggZOkicECFSyCMgoddiMAuw"}; ..