topic Re: how to get vulnerability signature pattern in Custom Signatures

how to get vulnerability signature pattern

Venkatesan_radhakrishnan — Sun, 28 Apr 2019 13:03:11 GMT

Palo alto is releasing content update every week and changes in default action will be changed periodically.

Recenty in Content version 8146 vulnerability 55570 Oracle WebLogic wls9-async Remote Code Execution Vulnerability action is set to resert-server.

How can i get the signature pattern used by this vulnerability to confirm the incoming data is vulnerable. When palo alto confirm incoming data is vulnerable by matching with this vulnerability id then how can i get that vulnerable data payload.

Regards

Venky

Re: how to get vulnerability signature pattern

reaper — Sun, 28 Apr 2019 16:19:42 GMT

If you enable extended (or single packet) pcap in the security profile, you will get the offending packet

Re: how to get vulnerability signature pattern

Venkatesan_radhakrishnan — Mon, 29 Apr 2019 05:37:11 GMT

Can i able to find the signature pattern used by specific vulnerability.

Regards

Venky

Re: how to get vulnerability signature pattern

reaper — Mon, 29 Apr 2019 21:45:10 GMT

If you know the associated CVE you can research the vulnerability on MITRE, but you cant extract the pattern from our database