topic Disabled Vulnerability Signatures: FTP evasion attack (id:30401) in General Topics

Disabled Vulnerability Signatures: FTP evasion attack (id:30401)

_slv_ — Mon, 08 Sep 2014 07:45:02 GMT

Hello

Could someone explain me why signature FTP evasion attack (id:30401) was disabled in thread update version 453?

This signature wasn't replaced by new one. Bruteforce attacs on FTP serwers still exist and nothing will change in this case.

With regards

SLawek

Re: Disabled Vulnerability Signatures: FTP evasion attack (id:30401)

_slv_ — Mon, 08 Sep 2014 08:05:44 GMT

Some update... there is another one signature "FTP: login Brute-force attempt id:40001", so 30401 was for different purposes.

Re: Disabled Vulnerability Signatures: FTP evasion attack (id:30401)

HULK — Mon, 08 Sep 2014 13:31:26 GMT

Hello Slv,

Content version 453, which was shipped on 9/3/2014, contained an erroneous entry. The last entry indicated that Threat ID 30401, "FTP Evasion Attack" had been disabled, when in fact no changes were made to this signature as part of content release 453. Please find below a KB article for the same: Release Notes Error for Content 453

Disabled Vulnerability Signatures (1)

Severity	ID	Attack Name	CVE ID	Vendor ID	Default Action	Minimum PAN-OS Version
critical	30401	FTP evasion attack			alert	3.1.0

Hope this helps.

Thanks

Re: Disabled Vulnerability Signatures: FTP evasion attack (id:30401)

_slv_ — Mon, 08 Sep 2014 17:38:00 GMT

Thank You