Qualys Releases Detection for Bash Shellshock Vulnerability

PRESS RELEASE

REDWOOD CITY, Calif. –– Sept. 29, 2014 –– Qualys, Inc. (NASDAQ: QLYS), a pioneer and leading provider of cloud security and compliance solutions, today announced that its Qualys Vulnerability Management (VM) cloud service detects the GNU Bash Shellshock (CVE-2014-6271) vulnerability.

Qualys customers can detect the Bash bug by scanning with the Qualys Vulnerability Management (VM) cloud service as QID 122693 and 13038. This means that Qualys customers can get reports detailing their enterprise-wide exposure whenever they next scan their assets, which allows them to get visibility into the impact in their organization and efficiently track the remediation speed of the issue.

Additionally, a vulnerability check for Shellshock is included in Qualys Freescan, which allows any organization to verify the security status of an Internet facing server.

“Bash allows attackers to specify arbitrary commands to execute by formatting an environment variable in a specific way. Given that the flaw has been around for more than10 years, almost all Linux and Unix machines running will be vulnerable and this could have a bigger impact than Heartbleed which we saw earlier this year,” said Wolfgang Kandek, Chief Technical Officer for Qualys, Inc.

For more information on Bash Shellshock, follow the conversation on our Laws of Vulnerabilities blog.