Custom Vulnerability Signature to block older versions of Chrome

cancel
Showing results for 
Search instead for 
Did you mean: 

Custom Vulnerability Signature to block older versions of Chrome

L0 Member

After reviewing this KB article: 

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClSOCA0

 

It looks like you can create custom vulnerability signatures for named browsers. 

 

Could you also do that to limit browser access via a security policy based on a minimum version number?

 

For example: create a vulnerability signature that identify any traffic via Chrome where it's version is older than v96. 

 

Also, for this to be effective, we'd to enable SSL decryption since the agent string is encrypted, correct?

1 REPLY 1

Cyber Elite
Cyber Elite

@CGirouard,

There's not a technical reason why your idea wouldn't work in theory. Keeping in mind that your triggering off of the User-Agent, and that this can be changed by a user, you would need to create a new vulnerability signature for each user-agent string you would want to actually block. You could use the pattern match to block older major versions, but you wouldn't likely do this down to a maintenance release. 

 

As a suggestion, if you manage these endpoints you could use something like AppLocker to block the execution of outdated versions of Chrome very easily through group policy. This would be a lot less overhead and would't be easy to bypass like a User-Agent pattern match signature would be. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!