IPS is not detecting threats

Shafaqat — Fri, 31 Jul 2020 10:03:35 GMT

Palo Alto has recently released signature for CVE-2020-3452. however when performing a POC, I cannot detect any threat. I am using link available to public use -

https://<domain>/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../

but when tried, there is no threat being detected or dropped on Palo.

Note: I have already enabled to drop all high and critical severity under vulnerability profile and attached same on Security Policy.

Re: IPS is not detecting threats

BPry — Fri, 31 Jul 2020 20:38:32 GMT

@Shafaqat,

It doesn't look like the signature is picking things up properly as far as the public PoC that Ahmed Aboul-Ela has published. I can certainly still execute PoC against an external ASA without any issues with the traffic fully being decrypted and the signature doesn't get triggered.

You might want to reach out to TAC and just make them aware of the issue with the identification. Since this is a brand new threat and PAN just released this signature, it's possible that it simply needs to be expanded a bit for additional coverage.

topic IPS is not detecting threats in General Topics

IPS is not detecting threats

Re: IPS is not detecting threats