topic Re: Enabling signatures in content update version 8317 in Advanced Threat Prevention Discussions

Enabling signatures in content update version 8317

Raydar — Thu, 01 Jul 2021 21:23:39 GMT

Checking CVE-2020-2040 it says "Until PAN-OS software is upgraded to a fixed version, enabling signatures in content update version 8317 will block attacks against CVE-2020-2040.", and I'm not sure what does "enabling signatures in content update version 8317" mean and can't find anything online about it.

Re: Enabling signatures in content update version 8317

OtakarKlier — Fri, 02 Jul 2021 19:03:27 GMT

Hello,

Interesting question. I would think that they mean to say install the signatures and make sure they are applied to a security policy?

Regards,

Re: Enabling signatures in content update version 8317

yblancovar — Fri, 02 Jul 2021 22:35:33 GMT

Hello @Raydar

In content version 8317 we released 4 new vulnerability signatures (UTIDs 59270, 59255, 59259, 59267) to provide coverage against CVE-2020-2040; so until you upgrade PAN-OS, you can enforce the traffic with a security policy with a Vulnerability Protection Profile and this will help to deter any potential attempt of exploitation of this vulnerability.

Re: Enabling signatures in content update version 8317

Fernando — Sat, 31 Jul 2021 08:59:31 GMT

Always review Content Release Notes for the list of newly-identified and modified application and threat signatures that the content release introduces. Content Release Notes also describe how the update might impact existing security policy enforcement and provides recommendations on how you can modify your security policy to best leverage what’s new.

Re: Enabling signatures in content update version 8317

bohnsack89 — Tue, 31 Aug 2021 12:05:24 GMT

Hello,

Please learn below article, It's may help you.

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/threat-prevention/best-practices-for-content-and-threat-content-updates/best-practices-security-first.html