Is PowerChute Network Shutdown version 3.1 Virtual Appliance for VMware vulnerable to BASH injection (Shellshock) issue?

Issue:
PowerChute Network Shutdown version 3.1 Virtual Appliance for VMware is vulnerable to BASH injection (Shellshock) issue.

Product:
PowerChute Network Shutdown Version 3.1 Virtual Appliance

Environment:
VMware

Cause:
BASH vulnerability

There is an easy test to determine the appliance is vulnerable. To check, from the command line type:

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

If vulnerable, the output will be:

vulnerable
 this is a test

Solution:
It is recommended to uninstall PowerChute Network Shutdown Version 3.1 Virtual Appliance and install PowerChute Network Shutdown Virtual Appliance Version 4.x

or update PowerChute Network Shutdown Version 3.1 Virtual Appliance with these steps

1 - from the command line type:
yum update

The OS will be updated and the vulnerability will be corrected.

To verify type:

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

The output should look like this

 bash: warning: x: ignoring function definition attempt
 bash: error importing function definition for `x'
 this is a test

2 - If you only want to update bash the command is
yum update bash

3 - If the appliance does not have internet access you can download the bash upgrade to a system that has Internet access from
http://mirror.centos.org/centos/5/updates/x86_64/RPMS/ Down load this file bash-3.2-33.el5_11.4.x86_64.rpm to the system and then copy it to the PCNS appliance using FTP utility such as WinSCP or Filezilla. Note: connection must be SFTP.

The command to update is rpm -U <full path to bash-3.2-33.el5_11.4.x86_64.rpm>
Example:  rpm -U /opt/bash-3.2-33.el5_11.4.x86_64.rpm