Suspect false positive matching for threat ID 95501 (Remote Desktop Licensing RCE)

[emyl_79]

Hello!

Not yet sure if this is a false positive or not, but since latest content update one of our customers is having issue with the new signature 95501 related to CVE-2024-38077. It looks like it's blocking legitimate traffic between RDS server and licensing server.

Wonder if anybody is having the same issue.

Thanks!

[RomainSalmon]

hello, i wrote the same topic on the forum this morning and i can ensure you that is false positive in our network. I opened a tac case. 

For the moment you can put the signature 95501 with IP address exception and the action to alert. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000008UscCAE

Best regards;

[RomainSalmon · Accepted solution]

Hello, they have disabled the signature in the new content update. https://live.paloaltonetworks.com/t5/customer-advisories/customer-issue-impacting-applications-and-t...

have a good day