Why CVE-2016-7189 vulnerability in MS Edge is not reported by MX67 ?

[FrederiqueC]

Greetings, 

I am receiving alarms from the border FW (Stormshield SN) to inform that packets coming from the meraki MX (used as internal FW, with Advanced Security License) are blocked because of CVE-2016-7189 vulnerability in MS Edge. The Meraki is performing NAT and because of NAT, I am not able to detect which end user is using an internet browser which is not up to date.

Which leads me to that question : how come that this vulnerability has not been flagged by the Meraki beforehand  ?

Thank you for sharing your knowledge on this matter.

Frederique

[CptnCrnch]

Hi Frederique,

MX could catch this one by using the IPS. Do you have this enabled? If so, which ruleset is enabled?

[FrederiqueC]

Hi CptnCrnch.

Yes, IPS is enabled and the ruleset is set to "Balanced". 

Actually I've checked the snort trule list, and I am not sure if there is one for this particular vulnerability. Do you think we should try with "security" ruleset even if connectivity is essential to our organisation ?

Thanks

F.

[PhilipDAth · Accepted solution]

100% of my clients use the security ruleset.

This is the definition of each ruleset so you can determine which CVEs are included.

https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Threat_Protection#Config...