cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Highlighted

HIPS Signature 6058 - Downgraded Severity in Recent Content Update?

Our HIPS signature 6058 (SSL Heartbleed Unencrypted Attack) changed from "High" to "Informational" in either the May 27 or June 1 out of cycle content update.  Is there any reason for this?

This was not mentioned in the release notes for either update, although in the May 27 update, it states this:

Note:

-

Due to a known issue (Refer Bug 969835)

Minimum content version for the Signatures

2851 and 6058

will

reflect 8.0.0.5660.

4 Replies
Highlighted

Re: HIPS Signature 6058 - Downgraded Severity in Recent Content Update?

Anybody?

Highlighted

Re: HIPS Signature 6058 - Downgraded Severity in Recent Content Update?

I don't know.

Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 5

Re: HIPS Signature 6058 - Downgraded Severity in Recent Content Update?

The  Host IPS Content 8.0.0.5735 - Signature 6058 is set to 'High' severiry as the default setting.  This has not been altered from previous content updates.

If you continue to have an issue, please contact McAfee Support so that we can proivde assistance.  The most common reason for when signatures show a different severify level is that the Host IPS Content policy has been changed on your ePO Server which will override the McAfee Default Content setting of 'High'.  Content signatures that have been Customized (changed from the default setting)  take precedence over the default signature settings.

Highlighted

Re: HIPS Signature 6058 - Downgraded Severity in Recent Content Update?

Yes, in 5735 this is indeed "high".  Interestingly enough, it was modified to reduce false positives.

However, in 5660, this signature suddenly became "informational".  I was looking at the McAfee Default policy, which is not subject to custom severity changes.  In 5709, this signature was modified to reduce false positives, and also became a "high" once again.  I'm trying to find out why there was a phantom severity change in 5660.

Message was edited by: damageinc on 7/7/14 3:09:04 PM CDT
You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community