Bash Version issue

[marc_dub]

Due to the recent Bash vulnerability I am running reports but the Bash software version only displays 3.2 as an example but when we check locally the version is 3.2.25 why would this be displayed.

[sukaitsu · Accepted solution]

I wrote this SQL Query, and it helped us narrow down vulnerable machines.

Linux: ShellShock Vulnerable ()

Select Top 1000000 tblAssets.AssetID,
  tblAssets.AssetName,
  tsysAssetTypes.AssetTypename,
  tsysAssetTypes.AssetTypeIcon10 As icon,
  tblLinuxSystem.OSRelease,
  tblAssets.IPAddress,
  tblSoftwareUni.softwareName,
  tblLinuxSoftware.Version,
  tblLinuxSoftware.InstallDate,
  tblLinuxSoftware.LastChanged
From tblAssets
  Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
  Inner Join tsysAssetTypes On tsysAssetTypes.AssetType = tblAssets.Assettype
  Inner Join tblLinuxSoftware On tblAssets.AssetID = tblLinuxSoftware.AssetID
  Inner Join tblSoftwareUni On tblSoftwareUni.SoftID =
    tblLinuxSoftware.SoftwareUniID
  Inner Join tblLinuxSystem On tblAssets.AssetID = tblLinuxSystem.AssetID
Where ((tblSoftwareUni.softwareName Like '%cgi%') Or
    (tblSoftwareUni.softwareName = 'bash' And
      DateDiff(day, tblLinuxSoftware.LastChanged, '2014-09-24') > 0)) And
  tblAssetCustom.State = 1 And tblAssets.Assettype = 11
Order By tblAssets.AssetName

[sukaitsu]

Lansweeper's API uses # rpm -qa to gather the installed software on Linux assets. The result from that command is what gets populated into the database.