Bash shell vulnerability in LEM

Hi Jamie,

We are investigating the issue internally. Assuming like you say the LEM appliance is vulnerable, there are a few mitigating factors:

1. LEM customers use a limited access shell to manage and maintain LEM, which does not use bash except when running external shell commands to make changes.
   1. This shell also does not allow customers to set or modify environment variables, so even when we do shell out commands, it shouldn't be possible to trigger the exploit.
2. It is possible to limit SSH access to LEM (for the limited shell or support-only users that have true bash shells) via the "restrictssh" command.
3. The last remaining vector for usage of the limited (or support) shell is the virtual appliance equivalent of physical access, which should be limited.

When we've determined the scope and resolution, we'l determine when the update will be released as well. Stay tuned....

In case you missed it: ShellShock Vulnerability and SolarWinds Products

LEM does have a vulnerable bash version, but it is not possible to exploit. We'll update in an upcoming release regardless.