topic Re: Java version detection and blocking old version in General Topics

Java version detection and blocking old version

Sly_Cooper — Wed, 14 May 2014 05:07:30 GMT

Hi,

With more and more vulnerabilities in Java, I would like to know if there is any way in PAN firewall to identify and blocked non latest Java traffic? The goal is to identify machines and inform owners to update their Java version. If not then block the Java traffic from that host.

Thanks in advance.

Re: Java version detection and blocking old version

HULK — Wed, 14 May 2014 06:01:42 GMT

Hello Sly_Cooper,

You can create a regex to match specific java versions ( latest) to allow through the PAN firewall. For all other versions, other than the latest one, set the action as "block". So, all the request will be logged into the PAN firewall.

Reference doc: Creating Custom Threat Signatures

NOTE: The Java spec is written so that JAR files may look like ZIP files in PAN.

Thanks

Re: Java version detection and blocking old version

Sly_Cooper — Thu, 22 May 2014 16:14:42 GMT

Hi HULK,

Do you have any example for Java version matching? How requests from java apps will be seen on PAN firewalls?

Thanks in advance.

Re: Java version detection and blocking old version

HULK — Thu, 22 May 2014 16:32:11 GMT

Hello Sly_Cooper,

You can take a packet capture on a test machine or PAN firewall from a host, where JAVA update is running. After taking the pcap file, you have to analyze the header to get the request information i.e "java version".

Thanks

Re: Java version detection and blocking old version

torm — Tue, 30 Sep 2014 08:41:31 GMT

Sly_Cooper : Have you been able to make vulnerability signatures (regex) for this? I'm looking to do the same thing, and if you have something to share, it would be great!

Re: Java version detection and blocking old version

Sly_Cooper — Tue, 11 Nov 2014 16:44:20 GMT

torm - Sorry I did not try it.