PSIRT Articles
The latest news from the Product Security Incident Response Team at Palo Alto Networks.
cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
About PSIRT Articles
Here you will find PSIRT-related information and happenings, as well as security advisories published by Palo Alto Networks' Product Security Incident Response Team.
Featured Article
Coverage for the Meltdown and Spectre vulnerabilities: Traps anti-exploitation mechanisms will not protect against exploiting of these vulnerabilities. The disclosed vulnerabilities are memory read vulnerabilities. They do not cause code execution. For an attacker to use these vulnerabilities, there likely would have been an initial attack phase that Traps may be able to prevent (e.g. a malicious EXE attempts to exploit the vulnerabilities). For more information on Microsoft’s updates, please see Microsoft Security Advisory ADV180002 Guidance to mitigate speculative execution side-channel vulnerabilities Note that these vulnerabilities are memory read vulnerabilities; they do not cause code execution. For an attacker to use these vulnerabilities in an attack, they would have to have already executed a successful initial attack that Traps may be able to prevent (e.g. a malicious EXE attempts to exploit the vulnerabilities). Compatibility: All the currently supported product lines (3.4, 4.0, and 4.1) were tested running on all the supported Operating System versions and certified to be compatible with the Microsoft Security updates. Note that the tests were performed on both physical and virtual machines. Find more information around Supported Operating Systems and Platforms on our Compatibility Matrix. https://www.paloaltonetworks.com/documentation/global/compatibility-matrix/traps/where-can-i-install-the-traps-agent Microsoft patch: Traps is compatible with the patches Microsoft released to fix CVE-2017-5753, CVE-2017-5715, and CVE-2017-5754 vulnerabilities.   Apple patch: Traps is compatible with macOS High Sierra 10.13.2 Supplemental Update including security improvements to Safari and WebKit to mitigate the effects of CVE-2017-5753 and CVE-2017-5715. Installing the Patch: Traps  4.0.5-h1, Traps 4.1.2-h1, and later automatically set the registry key Microsoft requires to be present for their security updates to install successfully. For more information on this registry key, please see Microsoft Knowledge Base Article 4072699.   Customers requiring assistance with the upgrade, or assistance with older versions can reach out to the Palo Alto Networks Support team. Find the Support contact for your region at https://www.paloaltonetworks.com/company/contact-support   Change Log   Friday, Jan. 12, 2018 Post updated to include the note at the bottom of the article regarding a forthcoming update. Tuesday, Jan. 23, 2018 Updated with information about the new releases that allow Windows to install the patches automatically. Friday, Jan. 26, 2018 Updated to clarify information around the Microsoft Windows registry key.
View full article
  • 29 Posts
  • 312 Subscriptions
Customer Advisories

Your security posture is important to us. If you’re a Palo Alto Networks customer, be sure to login to see the latest critical announcements and updates in our Customer Advisories area.

Learn how to subscribe to and receive email notifications here.

Listen to PANCast

PANCast is a Palo Alto Networks podcast that provides actionable insights to customers, helping you maximize your investment while improving your cybersecurity posture.

Labels
Top Contributors