IPS signatures for IE vulnerability

[AKrause]

Hello, are there any Fortiguard IPS signatures, which address the recent vulnerability in Microsoft Internet Explorer? http://technet.microsoft.com/en-us/security/advisory/2757760 best regards Andreas

[AKrause]

news from the front: appropriate signature MS.IE.execCommand.Use.After.Free will be released in next IPS signature package (version 3.237).

[RH2]

Be aware the default action is " allow"

[AKrause]

Is there any site to test the effectiveness of this pattern?

[uhchelpdesk]

I too would like to be able to test this IPS signature

[Secure_IT_BE_Nick]

Same strange thing here. I can see it in the IPS signatures but no way to enable it in the IPS UTM profile??

[cmberry]

Same strange thing here. I can see it in the IPS signatures but no way to enable it in the IPS UTM profile??

You need to alter an existing or create a new IPS Sensor. Then you add a new IPS filter which includes the signature you are talking about, and change the action to " BLOCK" . UTM Profiles>Intrusion Protection>IPS Sensor>[select a profile from drop down]>create new ips filter>change radio button to " Signature" >type name of IE signature you' re talking about>and change the bullet to " BLOCK' . Make sure to move this filter rule ABOVE/BEFORE the other generic defualt enable, default action rules. Hope this helps!

[Secure_IT_BE_Nick]

isting or create a new IPS Sensor. Then you add a new IPS filter which includes the signature you are talking about, and change the action to " BLOCK" . UTM Profiles>Intrusion Protection>IPS Sensor>[sel

Thx, still raises the question why this wasn' t blocked in the first place...