Siemens is working on developing patches for its products affected by the GNU Bash vulnerability called Shellshock.
Variants of Shellshock (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277 and CVE-2014-6278) can end up exploited by an attacker to escalate privileges and remotely execute arbitrary code on affected devices, according to a Siemens advisory.
The list of affected products includes ROX 1 versions prior to 1.16.0, and ROX 2 versions prior to 2.5.0. ROX (Rugged Operating System on Linux) is on various RUGGEDCOM industrial communications devices specially designed for harsh environments.
APE Linux V1.0 with ELAN installed also ended up affected by ShellShock. Products such as APE Linux V1.0, APE Linux V2, SINUMERIK 808D, 828D and 840D, SINUMERIK Operate Programming Package, and SINUMERIK Integrate CreateMyHMI do not suffer from the issue in their default configurations. However, users might configure them in a way that makes them vulnerable, Siemens said.
The company said ROX 1 and ROX 2 feel the affects only if the DHCP client, which is the potential attack vector, ends up enabled. APE Linux with ELAN ends up affected because the ELAN Web interface can be an attack vector.
While Siemens works on patches, the company advises ROX 1 and ROX 2 customers to protect themselves against potential attacks by deactivating automatic IP address assignment via DHCP and configure a static IP address. APE Linux customers whose installations are vulnerable to ShellShock attacks due to various modifications (installation of additional software or custom scripts) can apply the Debian patch.