topic CVE-2004-0230—GUESSING TCP SEQUENCE NUMBERS AND INJECTING RST PACKETS not in threat DB in Advanced Threat Prevention Discussions

CVE-2004-0230—GUESSING TCP SEQUENCE NUMBERS AND INJECTING RST PACKETS not in threat DB

Ben-Price — Thu, 08 Jul 2021 00:49:31 GMT

Hi All,

CVE-2004-0230 does not seem to show up in the Palo Alto Networks threat database, but the below KB article seems to indicate that PAN have introduced threat mitigation for this CVE in PAN-OS 6.0.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CllyCAC

I am wondering if this is an error in the PA threat database? or if mitigation for this threat has been removed from the PAN OS (which I believe unlikely)?

Can anyone shed any light on this issue?

Thanks in advance.

Re: CVE-2004-0230—GUESSING TCP SEQUENCE NUMBERS AND INJECTING RST PACKETS not in threat DB

Ben-Price — Fri, 09 Jul 2021 04:58:46 GMT

Can anyone assist with this question? Maybe @BPry @reaper could possibly comment.

Re: CVE-2004-0230—GUESSING TCP SEQUENCE NUMBERS AND INJECTING RST PACKETS not in threat DB

BPry — Fri, 09 Jul 2021 13:48:16 GMT

@Ben-Price,

I believe the mitigation that the article is talking about was actually PAN fixing the vulnerability within PAN-OS itself and not in direct relation to a threat signature being added to identify the traffic. Just as an FYI though, threat signatures are retired and they don't just stick around forever.

Re: CVE-2004-0230—GUESSING TCP SEQUENCE NUMBERS AND INJECTING RST PACKETS not in threat DB

Ben-Price — Sun, 11 Jul 2021 23:29:19 GMT

@BPry OK thanks for that info. A few questions:
So protection from this threat is built into the PAN OS and no need to configure an action within a Vulnerability profile then?