AWS Servers trigger Vulnerability

djr — Wed, 02 Dec 2015 11:04:50 GMT

We are seeing a high number of HTTP Non RFC-Compliant Response Found

Signature ID : 32880 CVE-2010-2561

All are logged from aws servers, evenly distributed across a large number of servers - 173 in one hour, each with 300-500 hits. I have packet captured the vulnerability and it is logging a seemingly innocuous XML file.

I suspect this is not a problem, but is something amazon have set up on their servers which is causing false positives against this signature.

the data returned is this:

<? xml version="1.0 "?>

<cross-domain-policy>

<allow-access-from domain="*" to-ports="*" />

</cross-domain-policy>

It's not causing a problem, but it's showing as more than 25% of all my vulnerabilities so it's masking other issues.

Do PAN watch this? If not how do we feed back regarding signatures?

Re: AWS Servers trigger Vulnerability

glastra1 — Wed, 02 Dec 2015 14:29:58 GMT

Best way I know is open a case requesting a false positive analysis.

Regards,

Re: AWS Servers trigger Vulnerability

djr — Wed, 02 Dec 2015 15:06:52 GMT

Thanks, that's what I expected and now having phrased my question correctly, my support partner is doing just that.

Regards

topic AWS Servers trigger Vulnerability in General Topics

AWS Servers trigger Vulnerability

Re: AWS Servers trigger Vulnerability

Re: AWS Servers trigger Vulnerability