topic Re: Internet Explorer 0 Day - Sept 17, 2012 in General Topics

Internet Explorer 0 Day - Sept 17, 2012

choff123 — Tue, 18 Sep 2012 15:53:43 GMT

Is there a signature for the new IE 0 day yet?

There is a metasploit module out so.. that means there a working exploit 'in the wild' to base a sig on...

Normally I find the CVE and then look it up in Threat Vault which will give me the threats version number (eg: 839-1155) that I can confirm is installed on my FW.

However this time, I cant find a CVE number so Im asking here.

Thanks

Re: Internet Explorer 0 Day - Sept 17, 2012

bnelson — Tue, 18 Sep 2012 17:38:43 GMT

We will be releasing a signature in this evenings content update329 with threat id's 35017 and 35018

Re: Internet Explorer 0 Day - Sept 17, 2012

choff123 — Tue, 18 Sep 2012 17:44:03 GMT

thanks!

Re: Internet Explorer 0 Day - Sept 17, 2012

ethiSEC — Wed, 19 Sep 2012 00:32:39 GMT

Has this update been made generally available yet?

Jason

Re: Internet Explorer 0 Day - Sept 17, 2012

PANUser-1234 — Wed, 19 Sep 2012 05:19:52 GMT

I received the release notes of update 329 already. But we don not get the update itself... We tried with manual download and with scheduled download on the firewall. But the latest we get is 328? When will the 329 be available for download?

Re: Internet Explorer 0 Day - Sept 17, 2012

mikand — Wed, 19 Sep 2012 05:36:12 GMT

The update mail arrived 8 hours ago but I still dont see it in the dynamic updates section at https://support.paloaltonetworks.com (when logged in) - only previous versions (328 and older) is currently available.

Re: Internet Explorer 0 Day - Sept 17, 2012

gafrol — Wed, 19 Sep 2012 06:01:50 GMT

Same here, Content update 329 was announced through email, but it's still not available on the support download page nor through the automatic update of the Firewall.

Our customers are waiting since the latest IE vuln. CVE-2012-4969 makes quite some noise in the media.

Re: Internet Explorer 0 Day - Sept 17, 2012

tkenning — Wed, 19 Sep 2012 06:15:44 GMT

Hi everybody,

when looking into the dynamic updates section via https://support.paloaltonetworks.com I do not see update 329, yet. 328 is the latest named one.

In Panorama I do not see availability of 329 as well.

The PA's itself have already updated to 329-1511! Looking into the release news (direct link using webGUI):

https://updates.paloaltonetworks.com/updates/ReleaseNotes.aspx?type=si&versionNumber=329-1511&content=contents&inc=False

https://updates.paloaltonetworks.com/updates/ReleaseNotes.aspx?type=si&versionNumber=329-1511&content=apps&inc=False

Default-action 35017: reset-client

Default-action 35018: alert

Re: Internet Explorer 0 Day - Sept 17, 2012

gafrol — Wed, 19 Sep 2012 06:29:56 GMT

That's hard to believe. I just forced an update check by hitting the check now button on the dyn. updates page of the FW. Still showing 328 as the latest one...

Can you send a screenshot ?

Re: Internet Explorer 0 Day - Sept 17, 2012

tkenning — Wed, 19 Sep 2012 06:42:53 GMT

Re: Internet Explorer 0 Day - Sept 17, 2012

pballa — Wed, 19 Sep 2012 06:47:29 GMT

I have the same problem. But a lot crazier. We have one Cluster and one Device has the new 329 and one is still on 328. And when i perform a check the Box still say that 328 is the latest release. One Box performs the update at 1am (Version 329) and one at 2am (Version 328).

Re: Internet Explorer 0 Day - Sept 17, 2012

mikand — Wed, 19 Sep 2012 06:51:36 GMT

Pff, photoshoped 😉

Re: Internet Explorer 0 Day - Sept 17, 2012

mikand — Wed, 19 Sep 2012 06:54:11 GMT

Could it be some issue with the update servers?

The ip was recently changed and perhaps the new (or old) server(s) didnt get the update as it should and by that customers (or support.paloaltonetworks.com for that case) doesnt see or have the latest update available?

Because at least I would expect that when the mail is sent (or arrived 🙂 the update should be available on the updateservers (and in support.paloaltonetworks.com).

Re: Internet Explorer 0 Day - Sept 17, 2012

tkenning — Wed, 19 Sep 2012 06:58:29 GMT

Heard about the IP change of the update servers, but ignored it.

We've been using updates.paloaltonetworks.com in our PAs in the past as well as today.

If I had faced update problems, I would have spend some time on hardcoding update IPs.

P.S.: I don't see 329-1511 in Panorama at all, too. As mentioned before.

Re: Internet Explorer 0 Day - Sept 17, 2012

ggutierrez — Wed, 19 Sep 2012 07:04:11 GMT

Content version 329-1511 had to be pulled due to a unexpected problems. An Emergency update containing the IE 0 day fix will be released soon.

Re: Internet Explorer 0 Day - Sept 17, 2012

koen_peetermans — Wed, 19 Sep 2012 08:55:24 GMT

update 330-1516 available now

Re: Internet Explorer 0 Day - Sept 17, 2012

gafrol — Wed, 19 Sep 2012 09:08:44 GMT

Thanks, downloaded and installed just fine !

Re: Internet Explorer 0 Day - Sept 17, 2012

stefan_h — Wed, 19 Sep 2012 13:46:45 GMT

Hi everybody,

thanks for the update. Anyway, I've got a question: Why are there two threat-ids obviously covering the same vulnerability? How do they differ and how do I have to interpret the different default actions?

The background of my question is that I'm not really sure what will happen if the vulnerability protection profile is configured to apply the "default" action for all "critical" threats --> will it execute "reset-client" or only "alert" or both?

PS: Sorry for asking, I'm aware that maybe this is a (dumb) newbie question...

Re: Internet Explorer 0 Day - Sept 17, 2012

mikand — Wed, 19 Sep 2012 19:49:05 GMT

Good question...

My current guess is that both will fire since they have the same info:

https://threatvault.paloaltonetworks.com/Home/ThreatDetail/35017

https://threatvault.paloaltonetworks.com/Home/ThreatDetail/35018

so first it will reset-client and then it will log (alert)... but that sounds odd because if default action is reset-client then logging is included in that - isnt it?

Or if someone wants just to monitor/log if/when such packets are seen then they would set this manually to alert wouldnt they?