cache poisoning issue

[jdfernandez444]

we are planning to deploy more Palo alto devices throughout our enterprise and were thinking of removing our existing Cisco ASA's. Our Cisco rep got word of this and met with us on why we should still keep the ASA's and go with their new products. He mentioned that the Palo Alto device is susceptible to the use of cache poisoning to bypass its security. I've been looking all around the web trying to see if the issue no longer affects the updated version. Unfortunately everything about the issue is over a year old. Any good news I can give my boss about the vulnerability?

[bat]

Hi jdfernandez444

Did you take a look at this blog post (though it is 2 years old):

App-ID Cache Pollution: Merry Christmas From Check Point - Palo Alto Networks BlogPalo Alto Networks...

As mentioned above app cache is no longer used for security policies by default after 5.0.2 and 4.1.11.

[_slv_]

Hi

I'm a fan of PA but You should read this too https://live.paloaltonetworks.com/thread/11580

Regards

Slawek

[jdfernandez444]

awesome...thanks everyone for your responses. It seems that on the web, everyone posts bad things but when there are fixes, no one posts those.

[bat · Accepted solution]

jdfernandez444 Glad to know that we could help. Please do mark the posts helpful/correct if it helped you

[mmmccorkle]

Agreed with everything mentioned above!

Don't let them talk you out of this solely because of this reason... this 'issue' has been fixed a while back and it not a concern moving forward.

Please look into all the features that the Palo Alto firewall provides!