topic Re: 485-2569 Dynamic Updates issue? in General Topics

485-2569 Dynamic Updates issue?

paul.stinson — Wed, 11 Feb 2015 02:07:44 GMT

Anyone noting a large increase in triggering of following threat ID's after this Update (485-2569) was applied?

( threatid eq 36485 ) - OpenSSL SSL/TLS MITM vulnerability

( threatid eq 36420 ) - OpenSSL TLS Heartbeat Information Disclosure Vulnerability - Reverse Heartbleed

I've rolled it back as it was dropping a lot of HTTPS traffic for sites that looked ok on closer inspection.

This is mainly for internal users connecting to external sites out of our control for the first threat ( 36485 ).

The reverse ones (36420) i'm not so worried about as they are probably dodgy sites to begin with.

Re: 485-2569 Dynamic Updates issue?

hmistry — Wed, 11 Feb 2015 18:08:17 GMT

Hi Paul,

You can take captures for those threat packets and open up a case.

Please refer: How to Submit a Virus/Vulnerability False Positive

Regards,

Hitesh Mistry

Re: 485-2569 Dynamic Updates issue?

tom.mccomb — Wed, 11 Feb 2015 20:05:18 GMT

I am having the same thing on my site. 100's of alerts coming from untrust-> our DMZ, there have been a 5 or 6 of the OpenSSL MITM from internal - untrust.

The updated installed last night at 3am on our boxes and alerts started at 3:08am. Reverting back for now.

Re: 485-2569 Dynamic Updates issue?

DavePalo — Thu, 12 Feb 2015 09:12:43 GMT

You may have seen already, but PA are advising that we should roll back to 484.

Regards,

Dave

Re: 485-2569 Dynamic Updates issue?

gbogojevic — Thu, 12 Feb 2015 09:20:58 GMT

Hi,

Palo Alto Networks has determined that Application and Threat Content version 485 may introduce false-positive triggers on certain IPS signatures involving SSL changes in that content release. We removed content release 485 from public update servers and are re-releasing Application and Threat Content 486 with the SSL changes removed. Please be informed that now content 486 is available.