04-16-2013 03:49 AM
Hi, I wonder if somebody can help me with a query?
I am running a 2050 as my firewall (I am new to looking after Palo Altos!). I have colleagues building workstations at another site coming across a VPN to access resources at my site. The router and links are working fine.
One particular application is not getting through and is being blocked as a threat. The entry in the log is:
SIP CSeq Header Field Integer Overflow
Several SIP based products are prone to an integer overflow while handling crafted requests containing invalid sequence numbers in CSeq header field. An attacker could exploit the vulnerability by sending a crafted request containing margin integer values in CSeq header. A successful exploit could lead to remote code execution or crash the server.
I have the option Add to Threat Exception which I would like to press to see if it fixes my problem. Before I press the button I would like to know where this exception is stored and how can I remove it if I want to reinclude it?
Going forward can I create a policy which only allows it through if it is coming from s specific IP subnet?
Any questions then let me know.
04-16-2013 04:09 AM
Sounds PANOS 5.0 would be nice for you.
The detail of threat log looks as below on 5.0.4.
You can select profile and also you can use Exempt IP address (this is new from 5.0)
04-16-2013 04:16 AM
Thanks for your quick reply. We did install 5.0.4 but it appeared to cause problems with our internet connectivity (This is still being looked at by PA) so we reverted back to 4.x
Do you know where the exception is stored if I press the Add Threat Exception button and whether it is possible to undo it?
04-16-2013 04:34 AM
You can choose profile even you run 4.1
The following doc might help you.
This also might help you.
04-16-2013 07:15 AM
You need to create a separate Vulnerability protection profile for the policy rules that you want to make exceptions for, as the exceptions are applied to the Vulnerability protection Profile. If you want it to be excepted from all rules, just except it from your generic Vulnerability protection profile.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!