IPS Updates

[rstefano]

How often are the IPS signatures updated? For instance this advisory was just posted @ https://www.us-cert.gov/ncas/alerts/TA17-164A

Thanks

[bommi · Accepted solution]

The mentioned vulnerabilities are old ones which should be included in the actual IPS Patterns.

If you want detailed information regarding the vulnerabilities and how Fortinet protect you against them, you can do a search in the FortiGuard Database:

[link]http://fortiguard.com/[/link]

Regards

bommi

[bommi · Accepted solution]

The mentioned vulnerabilities are old ones which should be included in the actual IPS Patterns.

If you want detailed information regarding the vulnerabilities and how Fortinet protect you against them, you can do a search in the FortiGuard Database:

[link]http://fortiguard.com/[/link]

Regards

bommi

[hmtay_FTNT · Accepted solution]

The IPS Definition is updated with a daily release from Tuesday to Friday every week. You can check the IPS release log to see if a particular CVE or vulnerability is covered. Alternatively, you can send an email to vulnwatch@fortinet.com or ips@fortinet.com to ask.

HoMing

[hmtay_FTNT]

I forgot to address the document. For the vulnerabilities in the doc, here are the signatures:

 CVE-2015-6585: Hangul.Word.Processor.ParaText.Type.Confusion

 CVE-2015-8651: Adobe.Flash.Loading.Data.Integer.Overflow

 CVE-2016-0034: MS.Silverlight.Text.Decoder.Memory.Corruption

 CVE-2016-1019: Adobe.Flash.LocalConnection.Object.Handling.Type.Confusion

 CVE-2016-4117: Adobe.Flash.Placement.object.Handling.Code.Execution

HoMing