topic Re: Microsoft Exchange zero-day 2022 in Advanced Threat Prevention Discussions

Microsoft Exchange zero-day 2022

JiaXiang — Fri, 30 Sep 2022 03:09:21 GMT

According to below link Microsoft Exchange have expose to new vulnerability again . I am using Palo Alto firewall PAN-OS 9.1.14 may I know Palo Alto firewall is able to detect this vulnerability ? and where to check it since I do not have CVE number.

New Microsoft Exchange zero-day actively exploited in attacks (bleepingcomputer.com)

Warning: New attack campaign utilized a new 0-day RCE vulnerability on Microsoft Exchange Server | Blog | GTSC - Cung cấp các dịch vụ bảo mật toàn diện (gteltsc.vn)

Re: Microsoft Exchange zero-day 2022

ymiyashita — Fri, 30 Sep 2022 05:29:53 GMT

Currently, Palo Alto Networks is researching on the vulnerability. There's no signature available yet.

For your reference: "A vulnerability/CVE is released; when will the vulnerability signature[IPS] be released? Why do some CVEs not have vulnerability signatures? What is default action?"
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HAOnCAO

When there's an update, I can share the status here.

Re: Microsoft Exchange zero-day 2022

Mikeya.Herbert — Fri, 30 Sep 2022 20:54:08 GMT

I check the portal site; however, nothing is public as of yet. Any update on the signature release?

Re: Microsoft Exchange zero-day 2022

ymiyashita — Mon, 03 Oct 2022 00:19:06 GMT

Here is the KB article for the vulnerabilities (CVE-2022-41040 and CVE-2022-41082). When there's an update on the signature coverage, the KB will also be updated.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000sZK9CAM

Re: Microsoft Exchange zero-day 2022

ymiyashita — Wed, 05 Oct 2022 02:08:59 GMT

A signature (TID:91368) for CVE-2022-41040 was released in the content version 8624.
Based on our research, blocking CVE-2022-41040 can be the mitigation of CVE-2022-41082.

Unit42 also published a blog:
https://unit42.paloaltonetworks.com/proxynotshell-cve-2022-41040-cve-2022-41082/