vulnerability id 31327

[nextgenhappines]

Hello,

Start 10/13,  I have been getting medium threat alert for vulnerability id 31327 (Attempted Antivirus Detection Bypass via Malformed ZIP Archive).  I beleve it is my iOS devices connect to apple store to download app updates.  Anyone else sees these?  It is using the action is reset-both, but I still able to complete the download and install without any problem.  

[jvalentine]

I have the same problem.  I ended up making a "permit itunes-base" security policy that points to a vulnerability protection profile with that specific signature disabled.  

[nextgenhappines]

@jvalentine Thanks for confirming it.  The strange part that I don't understand is the app update is still successful.  Also, the file that is alerting are all from Apple Itune app store.  I will think " I can trust Apple?!?".    I just want to know if this is a false positive or something real.

E

[jvalentine]

I'm willing to bet it's a false-positive, because it's Apple, right?  I'd recommend opening a case with TAC.  

[nextgenhappines]

Reply from TAC

We have released the modification to signature  (TID: 31327/ Attempted Antivirus Detection Bypass via Malformed ZIP Archive) in content version 646 on 12/13/2016.

[jvalentine]

My firewall installed that content version yesterday, but today I'm still getting false-positive hits for 31327 via itunes-base.  I count 15 hits just today.  Looks like the signature needs some additional work still.  

[nextgenhappines]

Same here, TAC told me to use CLI to reinstall the 646 update again.  If it still does not work, perform another packet captures and update the case.   I don't understand why TAC can't test it?  It is just iOS / Itune download app update from apple itune store.  It is easy to replicate.

E

[nextgenhappines]

The signature is disabed on 650-3771.  According to TAC, there are too many false positive.  Not sure what is the future plan of this specific signature will be.

E