ThreatID 33542 and Facebook

[TomS]

I'm seeing a lot of alerts in the last couple days for threatID 33542 when users are visiting facebook via http://www.facebook.com/

Could this be a false positive?  Anyone else seeing a jump in this threat?

Tnx, Tom

[Braden]

We are seeing the same thing over here. Every source IP seems to be Akami CDN servers that serve Facebook from our ISP, so I'm really thinking this is a false positive.

app: facebook-base
proto: tcp
threatid: Mozilla Firefox GeckoActiveXObject Method Denial of Service Vulnerability(33542)

[mikand]

Some more info:

http://wwapps.paloaltonetworks.com/ThreatVault/

http://wwapps.paloaltonetworks.com/ThreatVault/Home.aspx/ThreatDetail/33542

Attack Name: Mozilla Firefox GeckoActiveXObject Method Denial of Service Vulnerability

Description: Mozilla Firefox is prone to a denial of service vulnerability while parsing certain crafted HTTP responses.The vulnerability is due to the lack of proper checks on GeckoActiveXObject Method in the HTTP response, leading to an exploitable denial of service vulnerability. An attacker could exploit the vulnerability by sending a crafted HTTP response. A successful attack could lead to denial of service with the privileges of the current logged-in user.

Threat ID: 36871

References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3803

Severity: high

Category: dos

[CRHC]

Also seeing the same high count of events.  Not all events are stemming from workstations that have Firefox installed.

-mike

[sspringer]

There have been some changes made to Facebook code that is causing some false positives to be triggered for this ThreatID. We are working to address this issue in next week's update.

-Stefan

[bmaslakovic]

Is there an ETA on the patch / update?

[KP]

Would think/hope that it would be fixed in the weekly content (wednesday AM CET, tuesday PM USA) Update. Cheers.

[komure]

Hello All,

According to the result of our lab test,

it may be fixed with the latest content ver.308-1390.

- there is not this fix on release note though...

Tomoyuki Komure

[bmaslakovic]

Yes, we also have updated the content to 308-1390, and the alerts have stopped. Thanks!