Alert ID 95501 Microsoft Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

[RomainSalmon]

Hello,

After installing the last content update (https://proditpdownloads.paloaltonetworks.com/content/content-8880-8907.html?__token__=exp=172414152...)

I have a lot of traffic blocked from my servers to the licence microsoft server. But the licence servers get the patch from microsoft (CVE-2024-38077). Does anyone have the same problem ?

Other question more technical:  I configured Ip address exemption (licence servers ) on my IPS profile with the 'alert' action for this signature. Could you confirm, if this signature match other servers, traffic will still be blocked?

Edit: I have found the answer for IP-address-exemptions behaviour,

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000008UscCAE

I opened a tac case as well. 

Regards,

[Wijnand343]

Yes, we have the same issue!
We rolled back the update and disabled threat prevention update's as a temporary solution.
We also made a case with Palo Alto.
It looks like it also blocks none malicious traffic

[RomainSalmon]

Hello thanks for your reply. Concerning 'We rolled back the update and disabled threat prevention as a temporary solution.' : i cannot do this for securiy reasons, it's safer to disable only the signature if you want my opinion. If you have news from Palo Alto  : i m all ears.

Regards, 

[Wijnand343]

Update:

Yes, we are seeing multiple internal reports with False positives, at this stage, we are reviewing the signature with engineering for a possible false positive.

I will keep you updated!

[CSavoy]

On our side we just put the "Vulnerability Protection" to None on the matching security policy, waiting now for the corrective patch from Palo Alto.

[starki]

You can set an Exception for ID 95501 in your Vulnerability Protection Profile and set the Action to "alert".

[BrianClausen]

same issues here. Did make an exception.

[R.Ilves]

Same issue, added exception for now

[alix-c]

Hello, You need to update your license server.
Palo updated their threat database : 

Edit : I just saw, you installed the patch ..

[Tamas_Arato]

It looks like this specific content update (8880-8907) has been withdrawn. It is no longer visible at the Dynamic Updates or downloadable from the Customer Portal.

[RomainSalmon]

Update : it's official they are working on it : Version 8881 - signature disabled to address a possible fp issue