topic Re: threat ID 34904 in General Topics

threat ID 34904

schaleg2 — Thu, 11 Jun 2015 19:10:54 GMT

Anyone else noticing false positives on threat id 34904 since Tuesday's update?

Thanks

Eric

Re: threat ID 34904

mdjones — Thu, 11 Jun 2015 22:59:11 GMT

Yep, same here. We're seeing them for 36415 as well. Rolled back to 503-2740.

Re: threat ID 34904

pivvre — Fri, 12 Jun 2015 05:37:12 GMT

Looks like 504 is withdrawn now.

ThreatID 34904 first shows up in content update 498 as of May 6th, THreat ID 34904 relates to CVE-2012-2050.

In Content release 504 as of June 9th, there must have been a silent midofication to threat ID 34904. This is not mentioned in the release note.

We contacted our local PAN support partner; they had not heard of any problemes.

Quite interesting that the release (504) now is withdrawn - and as very often from PAN; without notice.
From my point of view PaloAlto Networks have huge challange here, to inform their evergrowing number of customers of bugs, flaws and withdrawels.

Re: threat ID 34904

Retired Member — Fri, 12 Jun 2015 07:22:07 GMT

Fyi

Palo Alto Networks has identified an anomaly with content version 504 that may degrade the detection rate of the antivirus signature content. In response to this issue, content version 504 is being pulled from the update server while the issue is investigated. Customers running 504 are advised to downgrade to 503. We will post an update when version 505 is available to address this issue.

Re: threat ID 34904

pivvre — Fri, 12 Jun 2015 07:27:47 GMT

Thanks for the info.
But as stated above; PAN know their users/customers - it shouldn't be too hard to inform them directly via email or local PAN support centers, not as a response to a post in the forum.

What about customers using manually threat update? (How) will they be informed to downgrade their content version?