Modified Vulnerability Signatures

[MHamad]

Hello,

On the last Threat and Content update on our Firewall, we suddenly started receiving alerts on our Firewall for a specific vulnerability (Threat ID 35427, CVE-2010-0476). Now this is an old CVE and upon checking the MS10-020 article, there was no update from Microsoft, but Palo Alto release notes suggested that this signature was modified.

Is a way to find out what change is made to the vulnerability signatures when Palo Alto modified a vulnerability signature?

Thanks,

Hamad

[reaper · Accepted solution]

Hi Hamad

If you suspect a threat/vulnerability is being triggered in error, please collect the information as outlined in the article below and open a support case:

How to submit an Anti-Virus false positive

How to submit a vulnerability signature false positive

[pankaku]

This could be a false positive.

[MHamad]

Do you mean that the update on the signature from PA may have an issue?

[pankaku]

Yes.

[reaper · Accepted solution]

Hi Hamad

If you suspect a threat/vulnerability is being triggered in error, please collect the information as outlined in the article below and open a support case:

How to submit an Anti-Virus false positive

How to submit a vulnerability signature false positive