To anticipate the questions you will surely get from your local Security Officer, I created a function to report which vSphere Servers in your environment are impacted, and which action to take.

Update October 5th 2015:

• Updated build numbers in $vmsaTab
• Corrected build number testing (thanks Richard)

The Script

function Get-VMSA-2015-0007
{
<#
.SYNOPSIS  Report on VMSA-2015-0007 vulnerabilities
.DESCRIPTION The function will look at all connected
  vSphere servers ($global:defaultviservers), and 
  report which ones are impacted by VMSA-2015-0007,
  and which action to take
.NOTES  Author:  Luc Dekens
.EXAMPLE
  PS> Get-VMSA-2015-0007
#>
  
  Begin
  {
  
    $vmsaTab = @(
      @{
        Vulnerability = 'CVE-2015-5177'
        Product = 'Vmware ESXi'
        Safe = @(
          @{
            Version = '5.5'
            Build = '3029837'
            Action = 'ESXi550-201509101'
          },
          @{
            Version = '5.1'
            Build = '3021178'
            Action = 'ESXi510-201510101'
          },
          @{
            Version = '5.0'
            Build = '3021432'
            Action = 'ESXi500-201510101'
          }
        )
      },
      @{
        Vulnerability = 'CVE-2015-2342'
        Product = 'VMware vCenter Server'
        Safe = @(
          @{
            Version = '6.0'
            Build = '3018521'
            Action = '6.0 u1'
          },
          @{
            Version = '5.5'
            Build = '3000241'
            Action = '5.5 u3'
          },
          @{
            Version = '5.1'
            Build = '3072311'
            Action = '5.1 u3b'
          },
          @{
            Version = '5.0'
            Build = '3073234'
            Action = '5.0 u3e'
          }
        )
      },
      @{
        Vulnerability = 'CVE-2015-1047'
        Product = 'VMware vCenter Server'
        Safe = @(
          @{
            Version = '5.5'
            Build = '2063318'
            Action = '5.5u2'
          },
          @{
            Version = '5.1'
            Build = '2308385'
            Action = '5.1u3'
          },
          @{
            Version = '5.0'
            Build = '3073234'
            Action = '5.0u3e'
          }
        )
      }
    )
  }
  
  Process
  {
    foreach($vc in $global:DefaultVIServers){
      Foreach($dc in (Get-Datacenter -Server $vc)){
        Foreach($esx in Get-VMHost -Location $dc -Server $vc){
          $product = $esx.ExtensionData.Config.Product
          foreach($entry in ($vmsaTab | where{$_.Product -eq $product.Name})){
            $esx | Select @{N='vCenter';E={$vc.Name}},
              @{N='Datacenter';E={$dc.Name}},
              @{N='Cluster';E={$_.Parent}},
              @{N='Name';E={$_.Name.Split('.')[0]}},
              @{N='Product';E={$product.Name}},
              Version,
              Build,
              @{N='CVE';E={$entry.Vulnerability}},
              @{N='Safe';E={
                $script:entrySafe = $entry.Safe | where{$esx.Version -match "^$($_.Version)"}
                if($script:entrySafe -ne $null){
                  if([int]$esx.Build -ge [int]$script:entrySafe.Build){[string]$true}else{[string]$false} 
                }
                else{'na'}
              }},
              @{N='Action';E={
                if($script:entrySafe -ne $null){
                  $script:entrySafe.Action
                }
                else{'na'}
              }}
          }
        }
      }
      $product = $vc.ExtensionData.Content.About
      foreach($entry in ($vmsaTab | where{$_.Product -eq $product.Name})){
        $vc | Select @{N='vCenter';E={$vc.Name}},
          @{N='Datacenter';E={''}},
          @{N='Cluster';E={''}},
          @{N='Name';E={$_.Name.Split('.')[0]}},
          @{N='Product';E={$product.Name}},
          Version,
          Build,
          @{N='CVE';E={$entry.Vulnerability}},
          @{N='Safe';E={
            $script:entrySafe = $entry.Safe | where{$vc.Version -match "^$($_.Version)"}
            if($script:entrySafe -ne $null){
              if([int]$vc.Build -ge [int]$entrySafe.Build){[string]$true}else{[string]$false}
            }
            else{'na'}
          }},
          @{N='Action';E={
            if($script:entrySafe -ne $null){
            $script:entrySafe.Action
            }
            else{'na'}
          }}
      }
    }
  }
}

Annotations

Line 17-85: The correlation between each of the vulnerabilities, the vSphere Server version and build and the fix mentioned in VMSA-2015-0007. Note that KB1014508, where one can normally find all update levels and the corresponding build number, is missing some of the proposed solutions from VMSA-2015-0007. For these I tried to determine the desired build number from the Product Download page under MyVMware. Also note that the Product Patches page under MyVMware, doesn’t seem to use the same terminology that is used in VMSA-2015-0007.

Line 91: the script uses the connected vCenters, as available in $Global:DefaultVIServers, to scan. It’s important that you connect to the vCenter(s) before you call the function.

Sample Usage

The function will look at all connected vCenters. It uses the values in $Global:DefaultVIServers to find these connected vSphere vCenters. For each vCenter it will query all connected ESXi servers.

Get-VMSA-2015-0007 |
Export-Csv -Path C:\VMSA-2015-0007.csv -NoTypeInformation -UseCulture

The function returns an object array with all results from the investigation. When you redirect the result to a CSV file, you will get something like this.

Note that CVE-2015-1047 and CVE-2015-2342 list different fix levels for the vCenter. The report lists the build corresponding with the CVE (Common Vulnerabilities and Exposures). You should of course apply the highest build, that way you will comply with both requirements.

Should you find any discrepancies in the product, versions and build numbers, please let me know.

Enjoy!

Since a lot of these Linux boxes are running under vSphere, we can use PowerCLI to produce such a report. The Invoke-VMScript cmdlet is the vehicle I use in the following function. With the Invoke-VMScript cmdlet it is very easy to execute, what is considered the best test to check for the vulnerability.

Update2 September 29 2014: the 2nd test from the Shellshocker gives a syntax error. The test is replaced by the one found on Michael Boelen‘s website in How to protect yourself against Shellshock Bash vulnerability. Big thanks to Wil van Antwerpen for the pointer.

Update1 September 29 2014: the function was updated to include tests for most of the known Shellshock vulnerabilities. The tests were collected from the Shellshocker site.

The Linux Shellshock Bug

The Shellshock, or Bash Bug, is a security issue in the Unix Bash shell. With specially crafted environment variables, a hacker can have malicious code executed on a Linux system.

Seen the widespread use of the Bash Shell, the risk imposed by this bug can not be underestimated.

The Script

function Get-VMShellShock{
<#
.SYNOPSIS  Check for ShellShock vulnerability
.DESCRIPTION The function will connect to all VMs, that run
  a Linux guest OS, to check if they are vulnerable for
  the ShellShock buug
.NOTES  Author:  Luc Dekens
.PARAMETER Location
  The function will check all VMs in this Location. This can
  be a Cluster, a Datacenter, a Folder, a Datastore...
.PARAMETER VM
  The function will check all VMs passed on this parameter.
.PARAMETER Credential
  The credential to logon to the Linux guest OS
.EXAMPLE
  PS> Get-VMShellShock -VM vm1 -Credential $cred
.EXAMPLE
  PS> Get-VMShellShock -Location $cluster -Credential $cred
#>

  [CmdletBinding()]
  param(
  [parameter(Mandatory=$true,ParameterSetName = "Location")]
  [VMware.VimAutomation.Sdk.Types.V1.VIObject]$Location,
  [parameter(Mandatory=$true,ParameterSetName = "VM")]
  [PSObject[]]$VM,
  [System.Management.Automation.PSCredential]$Credential
  )

  Begin{
    $exploits = @{
        'CVE_2014_6271' = 'x=''() { :;}; echo VULNERABLE'' bash -c :'
        'CVE_2014_7169' = 'env X=''() { (a)=>\'' bash -c "echo echo nonvuln" 2>/dev/null; [[ "$(cat echo 2> /dev/null)" == "nonvuln" ]] && echo "vulnerable" 2> /dev/null'
        'CVE_2014_7186' = 'bash -c ''true <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF'' || echo "vulnerable"'
        'CVE_2014_7187' = '(for x in {1..200} ; do echo "for x$x in ; do :"; done; for x in {1..200} ; do echo done ; done) | bash || echo "vulnerable"'
    }
    $oldProgressPreference = $ProgressPreference
    $ProgressPreference = "SilentlyContinue"
  }

  Process{
    if($PSCmdlet.ParameterSetName -eq "Location"){
      $vms = Get-VM -Location $entity | where {$_.GuestId -match "rhel|sles"}
    }
    elseif($PSCmdlet.ParameterSetName -eq "VM"){
      $vms = $VM| %{
        if($_ -is [System.String]){
          Get-VM -Name $_ | where {$_.GuestId -match "rhel|sles"}
        }
        else{
          $_
        }
      }
    }

    foreach($vm in $vms){
      $logon = "ok"
      $CVE_2014_6271 = $CVE_2014_7169 = $CVE_2014_7186 = $CVE_2014_7187 = $null
      if($vm.Guest.State -ne "notRunning"){
        $exploits.GetEnumerator() | %{
            Try{
              $result = Invoke-VMScript -VM $vm -ScriptText $_.Value -GuestCredential $Credential -ScriptType Bash -ErrorAction Stop
              Set-Variable -Name $_.Name -Value ($result.ScriptOutput -match "VULNERABLE")
            }
            Catch [VMware.VimAutomation.ViCore.Types.V1.ErrorHandling.InvalidGuestLogin]{
              $logon = "Guest logon failed"
            }
            Catch [VMware.VimAutomation.Sdk.Types.V1.ErrorHandling.VimException.VimException]{
              if($error[0].Exception.Message -match "Failed to resolve host"){
                $logon = "Failed to resolve host"
              }
              else{
                $logon = $error[0].Exception.Message
              }
            }
            Catch{
              $logon = $error[0].Execption.Message
            }
        }
      }
      New-Object PSObject -Property @{
        VM = $vm.Name
        OS = $vm.GuestId
        "OS Full" = $vm.Guest.OSFullName
        "VMware Tools" = $vm.Guest.State
        Logon = $logon
        CVE_2014_6271 = $CVE_2014_6271
        CVE_2014_7169 = $CVE_2014_7169
        CVE_2014_7186 = $CVE_2014_7186
        CVE_2014_7187 = $CVE_2014_7187
      }
    }
  }

  End{
    $ProgressPreference = $oldProgressPreference
  }
}

Annotations

Line 23-26: The function supports two parametersets, Location and VM
Line 31-36: The tests that are executed inside the Linux OS to determine if the guest OS is vulnerable to any of the known vulnerabilities. Tests 1,3 and 4 come from the Shellshocker website.
Line 33: Test 2 comes from the Linux Audit website
Line 43: The function currently only looks at Red Hat and SUSE systems, since these are currently the only ones I have to test. If someone needs to include other Linux distros, please contact me, and I can update the function.
Line 46-53: A simple implementation of Object By Name
Line 60: All the tests in the $exploits hash table are executed
Line 61-78: The Try part will use Invoke-VMScript to execute the test the vulnerability inside the guest OS. The Catch parts provide more information why a call to Invoke-VMScript might have failed. The last Catch code block is the “catch-all”.
Line 81-91: The results are returned as an object.

Sample Runs

The function accepts two types of calls, the first one uses the Location parameter. Then the function will check all VMs under that Location that run a Linux guest OS.

$username = "root"
$pswd = "MyPassword"

$pswdSecure = ConvertTo-SecureString -String $pswd -AsPlainText -Force
$cred = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $username,$pswdSecure

Get-VMShellShock -Location (Get-Cluster -Name MyCluster) -Credential $cred |
Select VM,OS,"OS Full","VMware Tools",CVE_2014_6271,CVE_2014_7169,CVE_2014_7186,CVE_2014_7187,Logon |
Export-Csv c:\shellshock.csv -NoTypeInformation -UseCulture

The second way to call the function uses the VM parameter. On this parameter you can pass one or more VMs, beit by name or by object.

$vm = Get-VM -Name lsrv001
Get-VMShellShock -VM $vm -Credential $cred |
Select VM,OS,"OS Full","VMware Tools",CVE_2014_6271,CVE_2014_7169,CVE_2014_7186,CVE_2014_7187,Logon

The result, when saved in a CSV file, looks something like this.

Community Participation

As I mentioned in the Annotations, the current function only looks at Red Hat and SUSE installations. The simple reason for that is that I currently do not have any other distributions available for testing in my lab.

If you use other Linux distributions in your VMs, please let me know which tests are conclusive for that guest OS. And I will try to add them to the function.

Enjoy !