Application and Threat Content Release Notes Version 429 Notes: A critical vulnerability in OpenSSL (CVE-2014-0160: OpenSSL Private Key Disclosure Vulnerability) was recently disclosed, affecting servers running OpenSSL 1.0.1 through 1.0.1f. This vulnerability allows arbitrary memory readout, which effectively exposes primary key material and compromises the integrity of the secure channel. To address this vulnerability, Palo Alto Networks has released an emergency content update that provides detection of attempted exploitation of CVE-2014-0160 with IPS vulnerability signature ID 36416 ("OpenSSL TLS Heartbeat Information Disclosure Vulnerability") with critical severity and a default action of block. Palo Alto Networks customers with a Threat Prevention subscription are advised to verify that they are running the latest content version on their devices. If you have any questions about coverage for this advisory, please contact Support. Modified Decoders (1) Name ssl New Vulnerability Signatures (1) Severity ID Attack Name CVE ID Vendor ID Default Action Minimum PAN-OS Version critical 36416 OpenSSL TLS Heartbeat Information Disclosure Vulnerability CVE-2014-0160 reset-server 3.1.0
... View more
