topic Re: Heratbleed CVE-2014-0160 - New Vulnerability Signatures in General Topics

Heratbleed CVE-2014-0160 - New Vulnerability Signatures

${userLoginName} — Fri, 11 Apr 2014 11:02:43 GMT

Palo Alto released multiple vulnerabilities for the Heartbleed bug.

New Vulnerability Signatures (3)

Severity	ID	Attack Name	CVE ID	Vendor ID	Default Action	Minimum PAN-OS Version
medium	40039	OpenSSL TLS Heartbeat Brute Force - Heartbleed	CVE-2014-0160		alert	3.1.0
informational	36417	OpenSSL TLS Heartbeat Found			alert	3.1.0
medium	36418	OpenSSL TLS Malformed Heartbeat Response Found - Heartbleed			alert	3.1.0

Modified Vulnerability Signatures (1)

Severity	ID	Attack Name	CVE ID	Vendor ID	Default Action	Minimum PAN-OS Version
critical	36416	OpenSSL TLS Heartbeat Information Disclosure Vulnerability - Heartbleed	CVE-2014-0160		reset-server	3.1.0

Are we fully protected when using the default settings?

Could there be any negative impact when setting "OpenSSL TLS Malformed Heartbeat Response Found - Heartbleed" also to drop? Or any of the other?

Kind regards

Re: Heratbleed CVE-2014-0160 - New Vulnerability Signatures

VinceM — Fri, 11 Apr 2014 12:01:56 GMT

Hi,

This new package it too new for having feeback? But you can test it with "alert" as action with no risk 🙂

Hope help

Re: Heratbleed CVE-2014-0160 - New Vulnerability Signatures

infotech — Fri, 11 Apr 2014 13:02:21 GMT

So there is another updated issue for heartbleed?

Re: Heratbleed CVE-2014-0160 - New Vulnerability Signatures

ericgearhart — Fri, 11 Apr 2014 15:41:40 GMT

FYI just for the benefit of the community, I have run ssltest.py against an internal server that is known to be susceptible to heartbleed and ssltest.py reports it as NOT VULNERABLE. We have tested nmap's ssl-heartbleed NSE script against the same server and Nmap's NSE script correctly identifies it as vulnerable.

Long story short, be careful what scripts you're running to verify if servers seem to be vulnerable or not

Re: Heratbleed CVE-2014-0160 - New Vulnerability Signatures

ericgearhart — Fri, 11 Apr 2014 15:43:47 GMT

Also I just looked and it appears that the NMAP NSE script causes our PA4020 to correctly flag "OpenSSL TLS Heartbeat found" when I scan the vulnerable server! So the PA threat update is working

Re: Heratbleed CVE-2014-0160 - New Vulnerability Signatures

infotech — Fri, 11 Apr 2014 15:51:23 GMT

And the choices that you have on the PA are to alert or block. How many users are blocking?