Palo Alto Networks Customer Advisory (Content 541) - Misidentification of Google Traffic as Ultrasurf

In content release 541, Palo Alto Networks introduced optimizations into the HTTP decoder to benefit the App-ID and Content-ID engines. These optimizations caused the “Safe Search” feature to behave incorrectly, causing problems for browsing to sites like google.com. Another change made in content release 541 to enhance the Ultrasurf coverage caused some of the google traffic to be misidentified as Ultrasurf. In response to these issues we have pulled content release 541. We will be releasing an emergency content release to ensure coverage of threat signatures and new applications of content release 541. In the interim, customers running content release 541 are advised to downgrade to version 540.

 

We understand that these problems may have resulted in an operational outage for some customers. We apologize for any impact this issue has caused, and we remain available to help.