Vulnerability Protection CVE-2013-0431

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Vulnerability Protection CVE-2013-0431

L2 Linker

I've spend some time on testing vulnerability protection on the PA firewall. The protection engine did a good job, but there is no protection against CVE-2013-0431: Java Applet JMX Remote Code Execution

I'm running PANOS 5.0.1 and Version Application and Threat ID: 364-1728.

You can find the results on my web site (www.accessdenied.be) in the document Configuring Vulnerability Protection.pdf. Step 0x5

Can some from Palo Alto check this out ?

regards

Johan

1 REPLY 1

L6 Presenter

Great document. A hint would be to add a reference in the end to for those who wants to read some more.

Regarding your JMX case the reverse shell seems to be detected however your IPS settings seems only be to look for specific CVE's (well of course since this is a test for specific CVE's but still).

What I wonder is would the reverse shell be identified if you setup a default such as this?

Critical: Block

High: Block

Medium: Block

Low: Default

Informational: Default

I mean even if the exploit itself isnt detected then hopefully the result of the exploit like reverse shell etc is detected.

Regarding the specific exploit, CVE-2013-0431 it doesnt seem to be covered according to ThreatVault Database: https://threatvault.paloaltonetworks.com/

I guess you would need to notify PA in case your message on this forum isnt enough - like a contact with the support@ or the appid team (which hopefully could redirect your request properly) http://researchcenter.paloaltonetworks.com/tools/

Speaking of which... is contacting support@ the proper way to get a response on when new threats will be included or does the ThreatVault team have their own mailaddress suitable for requests?

  • 1583 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!