topic Re: ThreatID 33542 and Facebook in General Topics

ThreatID 33542 and Facebook

TomS — Fri, 11 May 2012 17:35:09 GMT

I'm seeing a lot of alerts in the last couple days for threatID 33542 when users are visiting facebook via http://www.facebook.com/

Could this be a false positive? Anyone else seeing a jump in this threat?

Tnx, Tom

Re: ThreatID 33542 and Facebook

Braden — Fri, 11 May 2012 17:38:04 GMT

We are seeing the same thing over here. Every source IP seems to be Akami CDN servers that serve Facebook from our ISP, so I'm really thinking this is a false positive.

app: facebook-base
proto: tcp
threatid: Mozilla Firefox GeckoActiveXObject Method Denial of Service Vulnerability(33542)

Re: ThreatID 33542 and Facebook

mikand — Fri, 11 May 2012 19:00:55 GMT

Some more info:

http://wwapps.paloaltonetworks.com/ThreatVault/

http://wwapps.paloaltonetworks.com/ThreatVault/Home.aspx/ThreatDetail/33542

Attack Name: Mozilla Firefox GeckoActiveXObject Method Denial of Service Vulnerability

Description: Mozilla Firefox is prone to a denial of service vulnerability while parsing certain crafted HTTP responses.The vulnerability is due to the lack of proper checks on GeckoActiveXObject Method in the HTTP response, leading to an exploitable denial of service vulnerability. An attacker could exploit the vulnerability by sending a crafted HTTP response. A successful attack could lead to denial of service with the privileges of the current logged-in user.

Threat ID: 36871

References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3803

Severity: high

Category: dos

Re: ThreatID 33542 and Facebook

MGoodnow — Fri, 11 May 2012 19:09:04 GMT

Also seeing the same high count of events. Not all events are stemming from workstations that have Firefox installed.

-mike

Re: ThreatID 33542 and Facebook

sspringer — Fri, 11 May 2012 19:12:45 GMT

There have been some changes made to Facebook code that is causing some false positives to be triggered for this ThreatID. We are working to address this issue in next week's update.

-Stefan

Re: ThreatID 33542 and Facebook

bmaslakovic — Mon, 14 May 2012 14:54:49 GMT

Is there an ETA on the patch / update?

Re: ThreatID 33542 and Facebook

KP — Mon, 14 May 2012 16:03:19 GMT

Would think/hope that it would be fixed in the weekly content (wednesday AM CET, tuesday PM USA) Update. Cheers.

Re: ThreatID 33542 and Facebook

komure — Wed, 16 May 2012 04:54:22 GMT

Hello All,

According to the result of our lab test,

it may be fixed with the latest content ver.308-1390.

- there is not this fix on release note though...

Tomoyuki Komure

Re: ThreatID 33542 and Facebook

bmaslakovic — Wed, 16 May 2012 14:00:41 GMT

Yes, we also have updated the content to 308-1390, and the alerts have stopped. Thanks!