CVE-2020-1472 IPS Signatures

[Torb]

Hi

Is Broadcom working on an IPS signature for CVE-2020-1472? It was not listed in the latest Symantec response to  Microsoft Monthly Security bulletins.

Symantec Endpoint Response to Microsoft Monthly Security Bulletins

NVD

------------------------------
Syscom AS
------------------------------

[John Owens]

Hello Torb, 

Coverage does not exist as it is deemed not feasible at this point.

We suggest applying the patch as soon as you can.

Thanks,

------------------------------
John Owens
Principal Product Support
Symantec
United States
------------------------------

[John Owens]

Update to this:  

Symantec is investigating the possibility of IPS coverage for CVE-2020-1472. There is no ETA on when this investigation will be complete. Our suggestion is to patch as quickly as possible. I will update this thread once the investigation is complete.

------------------------------
John Owens
Principal Product Support
Symantec
United States
------------------------------

[hendrikvr123]

Hi John

 

Do you perhaps know if there will be coverage for CVE-2020-1596 as well ?

 

[John Owens]

Hi Hendrikvr123,

I am not aware of anything for  CVE-2020-1596. 

Thanks,

------------------------------
John Owens
Principal Product Support
Symantec
United States
------------------------------

[Amit Rathi]

Hi John,

Please confirm if Symantec releases signature / definition for CVE-2020-1472 IPS Signatures

[John Owens]

I will have an update on this later this afternoon.

------------------------------
John Owens
Principal Product Support
Symantec
United States
------------------------------

[John Owens]

We will be releasing IPS signature 32577 (OS Attack: Microsoft Netlogon CVE-2020-1472) today. As soon as I have confirmation of it being released and what revision I will post an update here.

------------------------------
John Owens
Strategic Support Engineer | Symantec Enterprise Division (SED)
Symantec
United States
------------------------------

[John Owens]

Hello. Looks like 09/22/20 rev 061 has posted for all versions. This will include IPS signature 32577 (OS Attack: Microsoft Netlogon CVE-2020-1472). 

[RChand]

Any coverage from SEP/SONAR?

[John Owens]

No. Only IPS.  The others were not feasible for this exploit.

------------------------------
John Owens
Strategic Support Engineer | Symantec Enterprise Division (SED)
Symantec
United States
------------------------------

[michael fong]

Hi John,

May I know IPS signature 32577 (OS Attack: Microsoft Netlogon CVE-2020-1472) is it released?
Where can I find the IPS Signatures on my SEPM ?
Thank you.

[John Owens]

Yes. It was released in 09/22/20 rev 061 IPS Content back in September.

------------------------------
John Owens
Strategic Support Engineer | Symantec Enterprise Division (SED)
Symantec
United States
------------------------------