Vulnerability Protection CVE-2013-0431

JohanL — Sat, 23 Mar 2013 12:20:57 GMT

I've spend some time on testing vulnerability protection on the PA firewall. The protection engine did a good job, but there is no protection against CVE-2013-0431: Java Applet JMX Remote Code Execution

I'm running PANOS 5.0.1 and Version Application and Threat ID: 364-1728.

You can find the results on my web site (www.accessdenied.be) in the document Configuring Vulnerability Protection.pdf. Step 0x5

Can some from Palo Alto check this out ?

regards

Johan

Re: Vulnerability Protection CVE-2013-0431

mikand — Sun, 24 Mar 2013 19:00:55 GMT

Great document. A hint would be to add a reference in the end to for those who wants to read some more.

Regarding your JMX case the reverse shell seems to be detected however your IPS settings seems only be to look for specific CVE's (well of course since this is a test for specific CVE's but still).

What I wonder is would the reverse shell be identified if you setup a default such as this?

Critical: Block

High: Block

Medium: Block

Low: Default

Informational: Default

I mean even if the exploit itself isnt detected then hopefully the result of the exploit like reverse shell etc is detected.

Regarding the specific exploit, CVE-2013-0431 it doesnt seem to be covered according to ThreatVault Database: https://threatvault.paloaltonetworks.com/

I guess you would need to notify PA in case your message on this forum isnt enough - like a contact with the support@ or the appid team (which hopefully could redirect your request properly) http://researchcenter.paloaltonetworks.com/tools/

Speaking of which... is contacting support@ the proper way to get a response on when new threats will be included or does the ThreatVault team have their own mailaddress suitable for requests?

topic Vulnerability Protection CVE-2013-0431 in General Topics

Vulnerability Protection CVE-2013-0431

Re: Vulnerability Protection CVE-2013-0431