Internet Explorer 0 Day - Sept 17, 2012

[choff123]

Is there a signature for the new IE 0 day yet?

• https://isc.sans.edu/diary/IE+Zero+Day+is+For+Real+/14107
• http://technet.microsoft.com/en-us/security/advisory/2757760

There is a metasploit module out so.. that means there a working exploit 'in the wild' to base a sig on...

Normally I find the CVE and then look it up in Threat Vault which will give me the threats version number (eg: 839-1155) that I can confirm is installed on my FW.

However this time, I cant find a CVE number so Im asking here.

Thanks

[pballa]

I have the same problem. But a lot crazier. We have one Cluster and one Device has the new 329 and one is still on 328. And when i perform a check the Box still say that 328 is the latest release. One Box performs the update at 1am (Version 329) and one at 2am (Version 328).

[mikand]

Pff, photoshoped 😉

[mikand]

Could it be some issue with the update servers?

The ip was recently changed and perhaps the new (or old) server(s) didnt get the update as it should and by that customers (or support.paloaltonetworks.com for that case) doesnt see or have the latest update available?

Because at least I would expect that when the mail is sent (or arrived 🙂 the update should be available on the updateservers (and in support.paloaltonetworks.com).

[tkenning]

Heard about the IP change of the update servers, but ignored it.

We've been using updates.paloaltonetworks.com in our PAs in the past as well as today.

If I had faced update problems, I would have spend some time on hardcoding update IPs.

P.S.: I don't see 329-1511 in Panorama at all, too. As mentioned before.

[ggutierrez]

Content version 329-1511 had to be pulled due to a unexpected problems. An Emergency update containing the IE 0 day fix will be released soon.