New Java vulnerability, CVE-2013-0422, released 1/11/13

[u13987]

Hello all,

Just wondering if anyone might be able to tell me whether this vulnerability, CVE-2013-0422, is being addressed? And, if so, when could we expect to see a patch for this? Thank you!

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0422&utm_source=dlvr.it&utm_medium=tw

http://msisac.cisecurity.org/advisories/2013/2013-006.cfm

[mbutt · Accepted solution]

Hi

Content release version 349 has been released today to cover this New Vulnerability .

Thank you

Numan

[u13987]

Thank you for the prompt reply!

[asher1ad]

To get this content release 349 to successfully protect against these threats, what threat categories do we need to enable and apply policy (Virus / Spyware / Vulneability)? Because we just recently implemented the PA's and we dont' know the impact of turning all these categories to block right now. Thanks.

[mikand]

They are all by the category "critical". So if you at least set "critical" to default action: block (instead of default) you should be safe.

Generally speaking using this profile is recommended:

critical: block

high: block

medium: block

low: default

informational: default

Default means the default action that PA has set for this vuln.

For example:

critical 35273 Oracle Java Runtime Environment Remote Code Execution Vulnerability CVE-2013-0422  reset-client 3.1.0

means that if detected the default action is "reset-client" (which includes a logentry aswell).

While:

critical 35276 Adobe Reader JPEG File Parsing Memory Corruption Vulnerability CVE-2013-0603 APSB13-02 alert 3.1.0

means that the default action is to only produce a logentry.

But if you set the default action for critical to block then both above will block (drop) the session if detected.

Also the 349 update only updates vuln signatures (the IPS stuff).