HP P4300 G2 underlying OS and ShellShock

[NDBT]

Is the underlying OS on the HP P4300 G2 devices susceptible to the Shellshock vulnerability reported last week?

[oikjn]

I'd assume so since it seems to be a universal issue.  We keep things blocked off at the firewall level so the SAN subnet can only talk with our other SAN subnet and then only with select computers on our trusted LANs so the potential for an exploit should be rather limited.  I wouldn't be too concerned unless you have your nodes open to the internet for some odd reason or are concerned about someone doing a targeted attach on you, but your firewall should provide enough seporation against any script kiddy.

[NDBT]

That all makes sense.  I am thinking more about our auditors asking if we've taken precautions against the threat.

[oikjn]

guess it depends on your environment, but if you can limit access to the SAN subnet and control things at the router/firewall point, then you should be able to make the argument that you have taken appropriate precautions.  Not knowing what the auditors are auditing to, I can't say if that will be enough, but the only ones I have to deal with are through ISO 9001:2008 and they would be satisfied with this protection plan (we didn't write in any extra requirements for IT over the basic ones).