topic Re: vulnerability id 31327 in General Topics

vulnerability id 31327

nextgenhappines — Sat, 22 Oct 2016 14:19:29 GMT

Hello,

Start 10/13, I have been getting medium threat alert for vulnerability id 31327 (Attempted Antivirus Detection Bypass via Malformed ZIP Archive). I beleve it is my iOS devices connect to apple store to download app updates. Anyone else sees these? It is using the action is reset-both, but I still able to complete the download and install without any problem.

Re: vulnerability id 31327

jvalentine — Sat, 22 Oct 2016 15:19:46 GMT

I have the same problem. I ended up making a "permit itunes-base" security policy that points to a vulnerability protection profile with that specific signature disabled.

Re: vulnerability id 31327

nextgenhappines — Sat, 22 Oct 2016 23:46:56 GMT

@jvalentine Thanks for confirming it. The strange part that I don't understand is the app update is still successful. Also, the file that is alerting are all from Apple Itune app store. I will think " I can trust Apple?!?". I just want to know if this is a false positive or something real.

Re: vulnerability id 31327

jvalentine — Sun, 23 Oct 2016 01:46:41 GMT

I'm willing to bet it's a false-positive, because it's Apple, right? I'd recommend opening a case with TAC.

Re: vulnerability id 31327

nextgenhappines — Thu, 15 Dec 2016 01:44:53 GMT

Reply from TAC

We have released the modification to signature (TID: 31327/ Attempted Antivirus Detection Bypass via Malformed ZIP Archive) in content version 646 on 12/13/2016.

Re: vulnerability id 31327

jvalentine — Thu, 15 Dec 2016 05:32:24 GMT

My firewall installed that content version yesterday, but today I'm still getting false-positive hits for 31327 via itunes-base. I count 15 hits just today. Looks like the signature needs some additional work still.

Re: vulnerability id 31327

nextgenhappines — Thu, 15 Dec 2016 16:01:24 GMT

Same here, TAC told me to use CLI to reinstall the 646 update again. If it still does not work, perform another packet captures and update the case. I don't understand why TAC can't test it? It is just iOS / Itune download app update from apple itune store. It is easy to replicate.

Re: vulnerability id 31327

nextgenhappines — Fri, 30 Dec 2016 19:03:46 GMT

The signature is disabed on 650-3771. According to TAC, there are too many false positive. Not sure what is the future plan of this specific signature will be.