Bash upgrade

[jimhoffmann]

Due to the "Shell Shock" bug looking to see what I need to do for Nagios XI to make sure it is patched. We are currently running 2014R1.4, but wondering if there are any update that we need to apply and how do we go about doing them?

[tmcdonald]

You should just be able to run "yum update bash -y" to update to the latest version. Note, however, that there have been three two patches (three vulnerabilities) released as of this writing and they still are finding ways to exploit bash. As far as Nagios goes, Core cgi files should be behind HTTP basic authentication, so they won't run unless the attacker also knows the login credentials, and our XI PHP files are run through mod_php from Apache which, to my understanding, is not vulnerable.