Meaning of CVE numbers in IPS signatures

DM — Thu, 11 Jul 2019 09:00:08 GMT

Hi,

we are currently running 77.30 and are going to upgrade to 80.x.

Anyway we started using IPS now with the 77.30 and I'm wondering about the meaning of the CVE numbers in the IPS signatures.

As an example I have the "Linux System Files Information Disclosure" going with CVE-2018-3948. The CVE number is about TP-Link devices.

So we don't run TP-Link devices and I first thought I could deactivate this protection. But then I checked the logged events and saw common directory traversal attacks. I checked if there are other "Linux System Files Information Disclosure" protections but cannot find any.

Is this signature just for TP-Link devices because of the CVE or is the CVE just an example for this attack pattern?

Thank you for your help.

Re: Meaning of CVE numbers in IPS signatures

Tal_Paz-Fridman — Thu, 11 Jul 2019 11:14:59 GMT

Hi,

You are correct and this is a bug. I will open an internal issue to have it corrected.

CVE-2018-3948 should be part of the Protection called TP-Link TL-R600VPN remote code execution which also has the Check Point Advisory CPAI-2019-0434

HTH

Tal

topic Meaning of CVE numbers in IPS signatures in Firewall and Security Management

Meaning of CVE numbers in IPS signatures

Re: Meaning of CVE numbers in IPS signatures