Is ESX v3.0 / 3.5 vulnerable to Shellshock?

[rvirene]

Greetings,

Is ESX v3.0 / 3.5 vulnerable to Shellshock? - I have searched all over and cannot find this answer. I tried finding out the linux shell version as well, but did not locate that. I thought Google would answer this in 2 minutes

Any help is appreciated.

Thanks,

Rick

[raog]

It should be as ESX 4 is vulnerable as well, with the difference being there is a patch available for ESX 4. I think the recommendation would be to upgrade to atleast ver 4 and apply the patch.

Security advisory located at

VMSA-2014-0010.4 | United States

Regards

Girish

[rvirene]

Thanks, Raog

I agree that upgrading is the way to go, as no patches will be published for version below ESX 4.0. I am still curious if versions 2 and 3 run the BASH shell.

Rick

[larstr]

All non-ESXi versions (1.×-4.×) have a RedHat based service console that has an old bash version installed.

Lars