Start 10/13, I have been getting medium threat alert for vulnerability id 31327 (Attempted Antivirus Detection Bypass via Malformed ZIP Archive). I beleve it is my iOS devices connect to apple store to download app updates. Anyone else sees these? It is using the action is reset-both, but I still able to complete the download and install without any problem.
@jvalentine Thanks for confirming it. The strange part that I don't understand is the app update is still successful. Also, the file that is alerting are all from Apple Itune app store. I will think " I can trust Apple?!?". I just want to know if this is a false positive or something real.
Reply from TAC
We have released the modification to signature (TID: 31327/ Attempted Antivirus Detection Bypass via Malformed ZIP Archive) in content version 646 on 12/13/2016.
My firewall installed that content version yesterday, but today I'm still getting false-positive hits for 31327 via itunes-base. I count 15 hits just today. Looks like the signature needs some additional work still.
Same here, TAC told me to use CLI to reinstall the 646 update again. If it still does not work, perform another packet captures and update the case. I don't understand why TAC can't test it? It is just iOS / Itune download app update from apple itune store. It is easy to replicate.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!