I've spend some time on testing vulnerability protection on the PA firewall. The protection engine did a good job, but there is no protection against CVE-2013-0431: Java Applet JMX Remote Code Execution
I'm running PANOS 5.0.1 and Version Application and Threat ID: 364-1728.
You can find the results on my web site (www.accessdenied.be) in the document Configuring Vulnerability Protection.pdf. Step 0x5
Can some from Palo Alto check this out ?
Regarding your JMX case the reverse shell seems to be detected however your IPS settings seems only be to look for specific CVE's (well of course since this is a test for specific CVE's but still).
What I wonder is would the reverse shell be identified if you setup a default such as this?
I mean even if the exploit itself isnt detected then hopefully the result of the exploit like reverse shell etc is detected.
Regarding the specific exploit, CVE-2013-0431 it doesnt seem to be covered according to ThreatVault Database: https://threatvault.paloaltonetworks.com/
I guess you would need to notify PA in case your message on this forum isnt enough - like a contact with the support@ or the appid team (which hopefully could redirect your request properly) http://researchcenter.paloaltonetworks.com/tools/
Speaking of which... is contacting support@ the proper way to get a response on when new threats will be included or does the ThreatVault team have their own mailaddress suitable for requests?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!