topic Re: New Java vulnerability, CVE-2013-0422, released 1/11/13 in General Topics

New Java vulnerability, CVE-2013-0422, released 1/11/13

u13987 — Fri, 11 Jan 2013 15:17:18 GMT

Hello all,

Just wondering if anyone might be able to tell me whether this vulnerability, CVE-2013-0422, is being addressed? And, if so, when could we expect to see a patch for this? Thank you!

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0422&utm_source=dlvr.it&utm_medium=tw

http://msisac.cisecurity.org/advisories/2013/2013-006.cfm

Re: New Java vulnerability, CVE-2013-0422, released 1/11/13

mbutt — Fri, 11 Jan 2013 18:53:57 GMT

Content release version 349 has been released today to cover this New Vulnerability .

Thank you

Numan

Re: New Java vulnerability, CVE-2013-0422, released 1/11/13

u13987 — Fri, 11 Jan 2013 18:57:41 GMT

Thank you for the prompt reply!

Re: New Java vulnerability, CVE-2013-0422, released 1/11/13

asher1ad — Fri, 11 Jan 2013 21:28:13 GMT

To get this content release 349 to successfully protect against these threats, what threat categories do we need to enable and apply policy (Virus / Spyware / Vulneability)? Because we just recently implemented the PA's and we dont' know the impact of turning all these categories to block right now. Thanks.

Re: New Java vulnerability, CVE-2013-0422, released 1/11/13

mikand — Fri, 11 Jan 2013 22:07:18 GMT

They are all by the category "critical". So if you at least set "critical" to default action: block (instead of default) you should be safe.

Generally speaking using this profile is recommended:

critical: block

high: block

medium: block

low: default

informational: default

Default means the default action that PA has set for this vuln.

For example:

critical 35273 Oracle Java Runtime Environment Remote Code Execution Vulnerability CVE-2013-0422 reset-client 3.1.0

means that if detected the default action is "reset-client" (which includes a logentry aswell).

While:

critical 35276 Adobe Reader JPEG File Parsing Memory Corruption Vulnerability CVE-2013-0603 APSB13-02 alert 3.1.0

means that the default action is to only produce a logentry.

But if you set the default action for critical to block then both above will block (drop) the session if detected.

Also the 349 update only updates vuln signatures (the IPS stuff).