threat ID 34904

[schaleg2]

Anyone else noticing false positives on threat id 34904 since Tuesday's update?

Thanks

Eric

[mdjones]

Yep, same here.  We're seeing them for 36415 as well.  Rolled back to 503-2740.

[pivvre]

Looks like 504 is withdrawn now.

ThreatID 34904 first shows up in content update 498 as of May 6th, THreat ID 34904 relates to CVE-2012-2050.

In Content release 504 as of June 9th, there must have been a silent midofication to threat ID 34904. This is not mentioned in the release note.

We contacted our local PAN support partner; they had not heard of any problemes.

Quite interesting that the release (504) now is withdrawn - and as very often from PAN; without notice.
From my point of view PaloAlto Networks have huge challange here, to inform their evergrowing number of customers of bugs, flaws and withdrawels.

[panos]

Fyi

Palo Alto Networks has identified an anomaly with content version 504 that may degrade the detection rate of the antivirus signature content.  In response to this issue, content version 504 is being pulled from the update server while the issue is investigated. Customers running 504 are advised to downgrade to 503.  We will post an update when version 505 is available to address this issue.

[pivvre]

Thanks for the info.
But as stated above; PAN know their users/customers - it shouldn't be too hard to inform them directly via email or local PAN support centers, not as a response to a post in the forum.

What about customers using manually threat update? (How) will they be informed to downgrade their content version?