topic Re: IPS Signatures in General Topics

IPS Signatures

Manuben88 — Tue, 27 Feb 2018 10:49:28 GMT

Hello friends,

I have some signatures with fortigate names and I neet to know the equivalence in Palo Alto, by the CVE Palo Alto dont indentify it, could anyone help me?

web_app3: Narcissus.Image.Configuration.Remote.Command.Execution
CVE-2015-1579 CVE-2014-9734

applications3: Ektron.XSLT.Transform.Remote.Code.Execution
CVE-2012-5357

applications3: OpenVAS.Web.Scanner

Thankss

Re: IPS Signatures

reaper — Tue, 27 Feb 2018 11:09:47 GMT

Are these CVE still active in the wild?

If CVE's are no longer active in the wild, or have long been patched, they are removed from the PANW threat vault to make way for more current signatures

Re: IPS Signatures

BPry — Tue, 27 Feb 2018 14:17:12 GMT

@Manuben88,

All of these CVEs you've identified, as @reaper made note to, have been addressed by software updates for a while. If you are still running software that this actually covers I would HIGHLY recommend that you update them to something current.

Ektron has been packed for literally years, the first two threats that you mention are only on select themes and only two of the affected themes are under active developement with patched versions.

I would say that this is mostly a 'non-issue' for the most part. You shouldn't actually need these signatures anymore.

Re: IPS Signatures

Manuben88 — Tue, 27 Feb 2018 15:14:20 GMT

Sorry but, If I understood:

This CVEs were active for a while but Palo Alto erase it from its signatures because with updating the host application made it-self non exploitable by this methods?

Thanks and regards.

Re: IPS Signatures

reaper — Tue, 27 Feb 2018 15:41:11 GMT

In short: yes

The longer version is: To ensure we are able to scan traffic quickly it is efficient to kjeep the threat database small in size: To be able to provide the best possible coverage we investigate which signatures are active 'in the wild', which ones are dangerous and which ones are still relevant

If a vulnerability is widely patched, it is safe to assume the threat level becomes lower, and if the signature is not picked up in the wild much any more, that means the signature has become obsolete and it is safe to dselete from the repository,, thus ensuring only the important signatures are used to scan your traffic