topic Re: New Flash volnureability! (CVE-2014-4671) in General Topics

New Flash volnureability! (CVE-2014-4671)

_slv_ — Thu, 10 Jul 2014 07:07:28 GMT

Hello

According to Adobe Security Bulletin its serious volnureability, when we can expects protection on PAN?

At the moment on https://threatvault.paloaltonetworks.com/ I can't find CVE-2014-4671

Regards

Slawek

Re: New Flash volnureability! (CVE-2014-4671)

HULK — Thu, 10 Jul 2014 07:20:54 GMT

Hello Slv,

\When a vulnerability is identified/posted, Palo Alto Networks will do a reverse engineer for that vulnerability, to understand how the vulnerability could possibly be exploited to, and then build possible protection. It’s not an simple task to create an appropriate signature. Hence, need to gather the right information about the vulnerability ( as much as possible) to build an IPS vulnerability signature, also Palo Alto Networks should take care about the false positives and performance implications in creating the signature.

So, please wait for further updates on this.

Thanks

Re: New Flash volnureability! (CVE-2014-4671)

_slv_ — Thu, 10 Jul 2014 07:42:42 GMT

Do You thing that we can expect emergency upgrade of therat signatures soon?

Re: New Flash volnureability! (CVE-2014-4671)

HULK — Thu, 10 Jul 2014 07:47:37 GMT

Hello slv,

You may contact with your PA SE for most recent activity.

Thanks

Re: New Flash volnureability! (CVE-2014-4671)

pulukas — Thu, 10 Jul 2014 14:47:27 GMT

You are watching the correct place to see when the update is available.

As HULK mentions, your sales engineer would be the best source for advance notice.

The sales engineer could also help you craft a manual work around if a vulnerability is a particularly high risk for your environment. You do need to be careful about these custom signatures as one of the reasons PA takes some time to produce a signature is to avoid a false positive that blocks production necessary traffic. The quick fixes based on initial information do carry a risk of blocking legitimate work on your network.

You need to measure your exposure risk for the particular vulnerability against the potential time lost in blocking legitimate traffic.

You can review the process in the documentation on creating a custom threat signature.

Creating Custom Threat Signatures