topic Re: Modified Vulnerability Signatures in General Topics

Modified Vulnerability Signatures

MHamad — Sun, 03 Jul 2016 08:34:39 GMT

Hello,

On the last Threat and Content update on our Firewall, we suddenly started receiving alerts on our Firewall for a specific vulnerability (Threat ID 35427, CVE-2010-0476). Now this is an old CVE and upon checking the MS10-020 article, there was no update from Microsoft, but Palo Alto release notes suggested that this signature was modified.

Is a way to find out what change is made to the vulnerability signatures when Palo Alto modified a vulnerability signature?

Thanks,

Hamad

Re: Modified Vulnerability Signatures

pankaku — Sun, 03 Jul 2016 08:57:51 GMT

This could be a false positive.

Re: Modified Vulnerability Signatures

MHamad — Sun, 03 Jul 2016 09:04:31 GMT

Do you mean that the update on the signature from PA may have an issue?

Re: Modified Vulnerability Signatures

pankaku — Sun, 03 Jul 2016 09:18:59 GMT

Yes.

Re: Modified Vulnerability Signatures

reaper — Mon, 04 Jul 2016 11:07:55 GMT

Hi Hamad

If you suspect a threat/vulnerability is being triggered in error, please collect the information as outlined in the article below and open a support case:

How to submit an Anti-Virus false positive

How to submit a vulnerability signature false positive