Alert ID 95501 Microsoft Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

[RomainSalmon]

Hello,

After installing the last content update (https://proditpdownloads.paloaltonetworks.com/content/content-8880-8907.html?__token__=exp=172414152...)

I have a lot of traffic blocked from my servers to the licence microsoft server. But the licence servers get the patch from microsoft (CVE-2024-38077). Does anyone have the same problem ?

Other question more technical:  I configured Ip address exemption (licence servers ) on my IPS profile with the 'alert' action for this signature. Could you confirm, if this signature match other servers, traffic will still be blocked?

Edit: I have found the answer for IP-address-exemptions behaviour,

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000008UscCAE

I opened a tac case as well. 

Regards,

[Wijnand343]

Yes, we have the same issue!
We rolled back the update and disabled threat prevention update's as a temporary solution.
We also made a case with Palo Alto.
It looks like it also blocks none malicious traffic

[RomainSalmon]

Hello thanks for your reply. Concerning 'We rolled back the update and disabled threat prevention as a temporary solution.' : i cannot do this for securiy reasons, it's safer to disable only the signature if you want my opinion. If you have news from Palo Alto  : i m all ears.

Regards, 

[Wijnand343]

I will continue to work with you to answer your queries and provide the necessary technical assistance.

As per the case description, I understand that you updated the content version to 8880 and after that, you noticed the traffic stopped working, once reverted the issue is resolved.

Kindly note that content 8880 provided coverage for a critical remote code execution vulnerability CVE-2024-38077 on Windows https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38077

The first thing to understand about vulnerability signatures is that these are just alerting you of any possible exploitation. They are only telling you that the firewall has detected a stream of traffic that matches a known signature for a vulnerability. It doesn't mean you have been exploited by someone.

Windows remote desktop licensing service is prone to a remote code execution vulnerability while parsing certain crafted DCE/RPC requests. The vulnerability is due to the lack of proper checks in DCE/RPC requests, leading to an exploitable remote code execution. An attacker could exploit the vulnerability by sending a crafted DCE/RPC request. A successful attack could lead to remote code execution

Can you please verify if the Remote Desktop Licensing Service is activated in your environment?

[Wijnand343]

Update:
As per the case description, I understand that you updated the content version to 8880 and after that, you noticed the traffic stopped working, once reverted the issue is resolved.

Kindly note that content 8880 provided coverage for a critical remote code execution vulnerability CVE-2024-38077 on Windows https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38077

The first thing to understand about vulnerability signatures is that these are just alerting you of any possible exploitation. They are only telling you that the firewall has detected a stream of traffic that matches a known signature for a vulnerability. It doesn't mean you have been exploited by someone.

Windows remote desktop licensing service is prone to a remote code execution vulnerability while parsing certain crafted DCE/RPC requests. The vulnerability is due to the lack of proper checks in DCE/RPC requests, leading to an exploitable remote code execution. An attacker could exploit the vulnerability by sending a crafted DCE/RPC request. A successful attack could lead to remote code execution.

[Wijnand343]

Update:

Yes, we are seeing multiple internal reports with False positives, at this stage, we are reviewing the signature with engineering for a possible false positive.

I will keep you updated!

[CSavoy]

On our side we just put the "Vulnerability Protection" to None on the matching security policy, waiting now for the corrective patch from Palo Alto.

[starki]

You can set an Exception for ID 95501 in your Vulnerability Protection Profile and set the Action to "alert".

[BrianClausen]

same issues here. Did make an exception.

[R.Ilves]

Same issue, added exception for now

[alix-c]

Hello, You need to update your license server.
Palo updated their threat database : 

Edit : I just saw, you installed the patch ..

[Tamas_Arato]

It looks like this specific content update (8880-8907) has been withdrawn. It is no longer visible at the Dynamic Updates or downloadable from the Customer Portal.

[RomainSalmon · Accepted solution]

Update : it's official they are working on it : Version 8881 - signature disabled to address a possible fp issue

[mtwinam]

looks like they resolved the issue as the exception added is now removed.