About fredallee

We have released an article on DevCenter with 3 signatures to identify and control March Madness Live traffic. Here's the link: ... View more

Puffin is a cloud browser meaning that they proxy all traffic for the client to the Puffin servers via SSL. You should be able to create a custom App-ID using the hostname of the server cert cloudmosa.com. ... View more

Not right now. However, we are looking at potentially adding this feature to the portal. A workaround would be to add an alias email address to your support account, and that alias would represent multiple email addresses. ... View more

You can indeed do this. In PAN-OS 4.0, a new action called block-ip was introduced. You can block based on source IP or source and destination IP pair. You can use this action in the vulnerability protection profile > Exceptions, find the signature and change the action to block-ip. Set the time from 1-3600 seconds. On the zone protection profile, you can also use the block-ip action associated with the reconnaissance protection for port scans and host sweeps. ... View more

There is no secret. The default actions for vulnerability protection and anti-spyware signatures have been available on the profile either under the custom signatures or under the exceptions area (depending on your PAN-OS version). For antivirus, the default action is always set to block. We are also working on an easier and automated method to make this and other threat meta data available in an upcoming PAN-OS release.   Alfred ... View more

Thanks Manfred. We have also written an AV signature for it and are planning to release it tomorrow. Alfred ... View more

No, the user would not see a block page for a vulnerability exploit that was detected. If a specially crafted web page contained an exploit, we would take the action associated with that signature on the profile, i.e. drop all packets and send a tcp reset to the client, server, or both, alert, etc. We don't have a block page for vulnerability protection. ... View more

Confirmed. This was a false positive and will be fixed in AV version 709. Thanks, Alfred ... View more

We are targeting to release a vulnerability signature to cover this tomorrow. In the mean time, here are some recommended mitigation steps that we have found: http://mail-archives.apache.org/mod_mbox/httpd-announce/201108.mbox/%3C20110824161640.122D387DD@minotaur.apache.org%3E http://www.edwiget.name/2011/08/quick-fix-for-apache-cve-2011-3192/ Alfred ... View more

Great question Neil. We look at the CVSS score but also do our own analysis of the vulnerabilities based on how easy it is to exploit the vulnerability, pervasiveness of the vulnerable product, impact of the vulnerability, etc. Here's a quick summary definition of each of the severity levels for vulnerabilities. CRITICAL vulnerabilities are those vulnerabilities that typically affect default installations of very widely deployed software, result in root compromise of servers, and the information required for exploitation (such as example exploit code) is widely available to attackers. Further, exploitation is usually straightforward, in the sense that the attacker does not need any special authentication credentials, knowledge about individual victims, and does not need to social engineer a target user into performing any special functions. HIGH vulnerabilities are typically those that have the potential to become CRITICAL, but have one or a few mitigating factors that make exploitation less attractive to attackers. For example, vulnerabilities that have many CRITICAL characteristics but are difficult to exploit, do not result in elevated privileges, or have a minimally sized victim pool are usually rated HIGH. Note that HIGH vulnerabilities where the mitigating factor arises from a lack of technical exploit details will become CRITICAL if these details are later made available. Thus, the paranoid administrator will want to treat such HIGH vulnerabilities as CRITICAL, if it is assumed that attackers always possess the necessary exploit information. MODERATE vulnerabilities are those where the scales are slightly tipped in favor of the potential victim. Denial of service vulnerabilities are typically rated MODERATE, since they do not result in compromise of a target. Exploits that require an attacker to reside on the same local network as a victim, only affect nonstandard configurations or obscure applications, require the attacker to social engineer individual victims, or where exploitation only provides very limited access are likely to be rated MODERATE. LOW vulnerabilities by themselves have typically very little impact on an organization's infrastructure. These types of vulnerabilities usually require local or physical system access or may often result in client side privacy or denial of service issues and information leakage of organizational structure, system configuration and versions, or network topology.Another type of low signature may indicate traffic that is necessary for attacking a server, such as Microsoft RPC Endpoint Mapper. In order to successfully attack Microsoft RPC vulnerabilities, an attack must first query an RPC endpoint first. INFORMATIONAL vulnerabilities may not actually be vulnerabilities, but rather suspicious events that are reported to call attention to security professionals that deeper problems could possibly exist.  ... View more

Right now, we don't deprecate IPS signatures as we have plenty of room for IPS signature growth. However, there will come a time when some of our signatures will need to be deprecated, but that won't happen for many more years to come. ... View more

Max 2 levels of zip/gzip decompression. There is no way to change it via CLI. ... View more

Ed, It's a false positive. We are fixing it in the next content release. Thanks, Alfred ... View more

For hex patterns in custom sigs use "\x" at the beginning of the hex pattern, then "\x" at the end of the hex pattern. For example:  .*\x42 3f 36 2b 7a 70 49 50 44 35 39 77 3d 3d 3f 3d\x. We will work on get this into the admin guide. Alfred ... View more