Disabled Vulnerability Signatures: FTP evasion attack (id:30401)

[_slv_]

Hello

Could someone explain me why signature FTP evasion attack (id:30401) was disabled in thread update version 453?

This signature wasn't replaced by new one. Bruteforce attacs on FTP serwers still exist and nothing will change in this case.

With regards

SLawek

[_slv_]

Some update... there is another one signature "FTP: login Brute-force attempt id:40001", so 30401 was for different purposes.

[HULK · Accepted solution]

Hello Slv,

Content version 453, which was shipped on 9/3/2014, contained an erroneous entry. The last entry indicated that Threat ID 30401, "FTP Evasion Attack" had been disabled, when in fact no changes were made to this signature as part of content release 453. Please find below a KB article for the same: Release Notes Error for Content 453

Disabled Vulnerability Signatures (1)

Severity	ID	Attack Name	CVE ID	Vendor ID	Default Action	Minimum PAN-OS Version
critical	30401	FTP evasion attack			alert	3.1.0

Hope this helps.

Thanks

[_slv_]

Thank You