485-2569 Dynamic Updates issue?

[paul.stinson]

Anyone noting a large increase in triggering of following threat ID's after this Update (485-2569) was applied?

( threatid eq 36485 ) - OpenSSL SSL/TLS MITM vulnerability

( threatid eq 36420 ) - OpenSSL TLS Heartbeat Information Disclosure Vulnerability - Reverse Heartbleed

I've rolled it back as it was dropping a lot of HTTPS traffic for sites that looked ok on closer inspection.

This is mainly for internal users connecting to external sites out of our control for the first threat ( 36485 ).

The reverse ones (36420) i'm not so worried about as they are probably dodgy sites to begin with.

[hmistry]

Hi Paul,

You can take captures for those threat packets and open up a case.

Please refer: How to Submit a Virus/Vulnerability False Positive

Regards,

Hitesh Mistry

[tom.mccomb]

I am having the same thing on my site.  100's of alerts coming from untrust-> our DMZ, there have been a 5 or 6 of the OpenSSL MITM from internal - untrust.

The updated installed last night at 3am on our boxes and alerts started at 3:08am.  Reverting back for now.

[DavePalo]

You may have seen already, but PA are advising that we should roll back to 484.

Regards,

Dave

[gbogojevic]

Hi,

Palo Alto Networks has determined that Application and Threat Content version 485 may introduce false-positive triggers on certain IPS signatures involving SSL changes in that content release. We removed content release 485 from public update servers and are re-releasing Application and Threat Content 486 with the SSL changes removed. Please be informed that now content 486 is available.