Internet Explorer 0 Day - Sept 17, 2012

[choff123]

Is there a signature for the new IE 0 day yet?

• https://isc.sans.edu/diary/IE+Zero+Day+is+For+Real+/14107
• http://technet.microsoft.com/en-us/security/advisory/2757760

There is a metasploit module out so.. that means there a working exploit 'in the wild' to base a sig on...

Normally I find the CVE and then look it up in Threat Vault which will give me the threats version number (eg: 839-1155) that I can confirm is installed on my FW.

However this time, I cant find a CVE number so Im asking here.

Thanks

[mikand]

The update mail arrived 8 hours ago but I still dont see it in the dynamic updates section at https://support.paloaltonetworks.com (when logged in) - only previous versions (328 and older) is currently available.

[gafrol]

Same here, Content update 329 was announced through email, but it's still not available on the support download page nor through the automatic update of the Firewall.

Our customers are waiting since the latest IE vuln. CVE-2012-4969 makes quite some noise in the media.

[tkenning]

Hi everybody,

when looking into the dynamic updates section via https://support.paloaltonetworks.com I do not see update 329, yet. 328 is the latest named one.

In Panorama I do not see availability of 329 as well.

The PA's itself have already updated to 329-1511! Looking into the release news (direct link using webGUI):

https://updates.paloaltonetworks.com/updates/ReleaseNotes.aspx?type=si&versionNumber=329-1511&conten...

https://updates.paloaltonetworks.com/updates/ReleaseNotes.aspx?type=si&versionNumber=329-1511&conten...

Default-action 35017: reset-client

Default-action 35018: alert

[gafrol]

That's hard to believe. I just forced an update check by hitting the check now button on the dyn. updates page of the FW. Still showing 328 as the latest one...

Can you send a screenshot ?

[tkenning]