topic Re: Suspect false positive matching for threat ID 95501 (Remote Desktop Licensing RCE) in Next-Generation Firewall Discussions

Suspect false positive matching for threat ID 95501 (Remote Desktop Licensing RCE)

emyl_79 — Tue, 13 Aug 2024 07:54:22 GMT

Hello!

Not yet sure if this is a false positive or not, but since latest content update one of our customers is having issue with the new signature 95501 related to CVE-2024-38077. It looks like it's blocking legitimate traffic between RDS server and licensing server.

Wonder if anybody is having the same issue.

Thanks!

Re: Suspect false positive matching for threat ID 95501 (Remote Desktop Licensing RCE)

RomainSalmon — Tue, 13 Aug 2024 12:59:11 GMT

hello, i wrote the same topic on the forum this morning and i can ensure you that is false positive in our network. I opened a tac case.

For the moment you can put the signature 95501 with IP address exception and the action to alert. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000008UscCAE

Best regards;

Re: Suspect false positive matching for threat ID 95501 (Remote Desktop Licensing RCE)

RomainSalmon — Wed, 14 Aug 2024 08:47:02 GMT

Hello, they have disabled the signature in the new content update. https://live.paloaltonetworks.com/t5/customer-advisories/customer-issue-impacting-applications-and-threats-content-update/ta-p/594842

have a good day