Palo Alto reveals critical bugs and March 16th patch deadline

Palo Alto Networks has revealed four new nasties, one of which can allow remote code execution and DDOS attacks on its boxen, and given users until March 16th to patch them. The company's security advisory page lists the four bugs but doesn't mention the deadline. That date has, however, been shared in an email to customers …

[Anonymous Coward]

GlobalProtect portal doesn't protect

So, adding a protection device to your network actually makes it less secure? Why didn't these bugs show up when Palo Alto did a security review on the said devices? They did perform a security review on the devices before releasing to market?

[Bbaggins]

Re: GlobalProtect portal doesn't protect

Tell that to Microsoft, Apple and Google. They never have security issues!

Or Cisco: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160120-ucsm

Or Fortinet: https://www.helpnetsecurity.com/2016/01/13/fortinet-says-backdoor-found-in-fortios-is-a-management-authentication-issue/

https://its.ny.gov/security-advisory/vulnerability-fortinet-fortios-could-allow-unauthorized-remote-access

Or Symmantec: https://www.us-cert.gov/ncas/current-activity/2014/08/04/Local-Privilege-Escalation-Vulnerability-Symantec-Endpoint

Or Kaspersky: https://www.exploit-db.com/exploits/10484/

Or .....

If you are a developer that is infallible, please let me know! I could use your help and would pay big $$$$

[jasonmaynard]

@bbaggins - I am not sure that you really answered the question posed. I love your response as it is a very similar response I get from my kids. "he did this and you did not say anything" or "what about the time that you overlooked this issue". Instead of pointing out what others are doing you would be better served in explaining what is or what is not being done in regards to the question being asked.

Since you felt the need to highlight vulnerabilities from Cisco let me provide some insight for the folks reading this thread. Vulnerabilities from time to time may be discovered and therefore Cisco has a mature process in disclosing and remediating these vulnerabilities as they are discovered. (beyond a signature).

PSIRT - Addressing security issues in Cisco products is the responsibility of the Cisco Product Security Incident Response Team (PSIRT). The Cisco PSIRT is a dedicated, global team that manages the receipt, investigation, and public reporting of security vulnerability information that is related to Cisco products and networks.

http://www.cisco.com/en/US/products/products_security_advisories_listing.html

Cisco also has developed transparency and trustworthy computing and more can be found here - http://www.cisco.com/c/en/us/about/trust-transparency-center/built-in-security/building-trustworthy-systems.html

Proper knowledge is power