topic Re: Cannot download a file on php.net in General Topics

Cannot download a file on php.net

ffgolf — Wed, 19 Oct 2011 10:46:40 GMT

Hi,

I have an issue wen my co-worker try to download a file from php.net.
I cannot find wich progam is called in my policies rules.

The file is available at : http(s)://pecl.php.net/get/oci8-1.4.6.tgz and cannot download it.

Thank you and sorry for my bad english

M.B

Re: Cannot download a file on php.net

gswcowboy — Wed, 19 Oct 2011 19:08:47 GMT

You could be hitting a threat(virus/vulnerability) so check your threat logs. Open a CLI and filter the session table for your IP.

> show session all filter source 10.10.10.10 state discard

This will give you an indication on what's going on when you're trying to download that file. You can then show the session id via the following:

rkalugdan@lab-54-PA-2020(active-primary)> show session id <value> <1-2147483648> Show specific session information

Regards,

Renato

Re: Cannot download a file on php.net

ffgolf — Thu, 20 Oct 2011 10:41:14 GMT

Thank you for your great help Rkalugdan.

The session was identified as RSS application, is it a bug ?
I add RSS application in my policies and now it's work.

best regard
M.B

Re: Cannot download a file on php.net

gswcowboy — Thu, 20 Oct 2011 13:12:50 GMT

If there's a false positive involved, please open a ticket with PAN Support so that we can investigate further. If it is indeed a bug, our Threat Team will deploy the necessary fix in an upcoming release(threat/virus).

Regards,

Renato