This update package improves the detection capabilities of the Forcepoint LLM system.
| RELEASE DATE: | Thursday August 12, 2021 |
| MD5 CHECKSUM: | 9ec0eb4a09d897b7cdbf18f94c02e588 |
| SHA1 CHECKSUM: | 59170969d4a6c41452ad7a16d04f2c1b2f833854 |
| SHA256 CHECKSUM: | 387980f8365e3fd49698c04a0c70349449c2241a03740497ab0bdaedeb0be070 |
UPDATE CRITICALITY: HIGH
List of detected attacks in this update package:
| Risk level | Description | Reference | Vulnerability |
|---|---|---|---|
| High | An attempt to exploit a vulnerability in Dnsmasq detected. | CVE-2020-25687 | Dnsmasq-Sort_rrset-CVE-2020-25687-Out-Of-Bounds-Write |
| High | An attempt to exploit a vulnerability in Dnsmasq detected. | CVE-2020-25682 | Dnsmasq-extract_Name-Out-Of-Bounds-Write |
| High | An attempt to exploit a vulnerability in Apache Tomcat detected. | CVE-2020-13935 | Apache-Tomcat-WebSocket-Infinite-Loop-DoS |
| High | An attempt to exploit a vulnerability in Code Remote - Containers detected. | CVE-2021-31213 | Microsoft-Visual-Studio-Code-Remote-Containers-Extension-RCE |
| High | An attempt to exploit a vulnerability in Jenkins Selenium HTML Report Plugin detected. | CVE-2021-21672 | Jenkins-Selenium-HTML-Report-Plugin-XML-External-Entity-Injection |
| High | An attempt to exploit a vulnerability in Automattic WooCommerce Blocks feature plugin detected | CVE-2021-32789 | Automattic-Woocommerce-Blocks-Wordpress-Plugin-Store-API-SQL-Injection |
| High | Snake Keylogger infection traffic was detected | No CVE/CAN | Snake-Keylogger-Infection-Traffic |
| High | Snake Keylogger infection traffic was detected | No CVE/CAN | Snake-Keylogger-Infection-Traffic |
| High | Malicious redirection was detected | No CVE/CAN | Malicious_Download_Redirect |
| High | An attempt to exploit a vulnerability in NetGear ProSAFE NMS300 detected | CVE-2021-27276 | NetGear-ProSafe-NMS300-Mibcontroller-Realname-Directory-Traversal |
| High | An attempt to exploit a vulnerability in Nagios Enterprises Log Server detected | CVE-2021-35478 | Nagios-Log-Server-Audit-Log-And-Alert-History-Reflected-Cross-Site-Scripting |
| High | An attempt to exploit a vulnerability in Atlassian JIRA and Service Management detected. | CVE-2020-36239 | Atlassian-JIRA-And-Service-Management-Ehcache-Rmi-Insecure-Deserialization |
| High | Cobalt Strike C2 HTTP traffic was detected | No CVE/CAN | Cobalt-Strike-C2-HTTP-Traffic |
Jump to: Detected Attacks Other Changes
DETECTED ATTACKS
New detected attacks:
HTTP Client Stream
| Risk | Vulnerability/Situation | References | Related Fingerprint | Situation Type |
|---|---|---|---|---|
| High | Apache-Tomcat-WebSocket-Infinite-Loop-DoS | CVE-2020-13935 | HTTP_CS-Apache-Tomcat-WebSocket-Infinite-Loop-DoS | Suspected Denial of Service |
| High | Microsoft-Visual-Studio-Code-Remote-Containers-Extension-RCE | CVE-2021-31213 | HTTP_CS-Microsoft-Visual-Studio-Code-Remote-Containers-Extension-RCE | Suspected Compromise |
| High | Jenkins-Selenium-HTML-Report-Plugin-XML-External-Entity-Injection | CVE-2021-21672 | HTTP_CS-Jenkins-Selenium-HTML-Report-Plugin-XML-External-Entity-Injection | Suspected Disclosure |
FTP Client Stream
| Risk | Vulnerability/Situation | References | Related Fingerprint | Situation Type |
|---|---|---|---|---|
| High | Snake-Keylogger-Infection-Traffic | No CVE/CAN | FTP_CS-Snake-Keylogger-Infection-Traffic | Suspected Botnet |
SMTP Client Stream
| Risk | Vulnerability/Situation | References | Related Fingerprint | Situation Type |
|---|---|---|---|---|
| High | Snake-Keylogger-Infection-Traffic | No CVE/CAN | SMTP_CS-Snake-Keylogger-Infection-Traffic | Suspected Botnet |
DNS UDP Server Message
| Risk | Vulnerability/Situation | References | Related Fingerprint | Situation Type |
|---|---|---|---|---|
| High | Dnsmasq-Sort_rrset-CVE-2020-25687-Out-Of-Bounds-Write | CVE-2020-25687 | DNS-UDP_Dnsmasq-Sort_rrset-CVE-2020-25687-Out-Of-Bounds-Write | Suspected Compromise |
| High | Dnsmasq-extract_Name-Out-Of-Bounds-Write | CVE-2020-25682 | DNS-UDP_Dnsmasq-extract_Name-Out-Of-Bounds-Write | Suspected Compromise |
TCP Client Stream Unknown
| Risk | Vulnerability/Situation | References | Related Fingerprint | Situation Type |
|---|---|---|---|---|
| High | Atlassian-JIRA-And-Service-Management-Ehcache-Rmi-Insecure-Deserialization | CVE-2020-36239 | Generic_CS-Atlassian-JIRA-And-Service-Management-Ehcache-Rmi-Insecure-Deserialization | Suspected Compromise |
HTTP Request URI
| Risk | Vulnerability/Situation | References | Related Fingerprint | Situation Type |
|---|---|---|---|---|
| High | Automattic-Woocommerce-Blocks-Wordpress-Plugin-Store-API-SQL-Injection | CVE-2021-32789 | HTTP_CSU-Automattic-Woocommerce-Blocks-Wordpress-Plugin-Store-API-SQL-Injection | Suspected Compromise |
HTTP Request Header Line
| Risk | Vulnerability/Situation | References | Related Fingerprint | Situation Type |
|---|---|---|---|---|
| High | Cobalt-Strike-C2-HTTP-Traffic | No CVE/CAN | HTTP_CSH-Cobalt-Strike-C2-HTTP-Traffic | Suspected Botnet |
HTTP Normalized Request-Line
| Risk | Vulnerability/Situation | References | Related Fingerprint | Situation Type |
|---|---|---|---|---|
| High | NetGear-ProSafe-NMS300-Mibcontroller-Realname-Directory-Traversal | CVE-2021-27276 | HTTP_CRL-NetGear-ProSafe-NMS300-Mibcontroller-Realname-Directory-Traversal | Suspected Compromise |
| High | Nagios-Log-Server-Audit-Log-And-Alert-History-Reflected-Cross-Site-Scripting | CVE-2021-35478 | HTTP_CRL-Nagios-Log-Server-Audit-Log-And-Alert-History-Reflected-Cross-Site-Scripting | Suspected Compromise |
Text File Stream
| Risk | Vulnerability/Situation | References | Related Fingerprint | Situation Type |
|---|---|---|---|---|
| High | Malicious_Download_Redirect | No CVE/CAN | File-Text_Malicious_Download_Redirect | Suspected Attack Related Anomalies |
Updated detected attacks:
TCP Client Stream Unknown
| Risk | Vulnerability/Situation | References | Related Fingerprint | Situation Type | Change Description | |
|---|---|---|---|---|---|---|
| High | PostgreSQL-Database-Datetime-Buffer-Overflow | CVE-2014-0063 | Generic_CS-PostgreSQL-Database-Datetime-Buffer-Overflow | Suspected Compromise |
|
LIST OF OTHER CHANGES:
New objects:
| Type | Name |
|---|---|
| Category | Jenkins Selenium HTML Report Plugin |
| Category | Automattic WooCommerce |
Updated objects:
| Type | Name | Changes |
|---|---|---|
| IPList | TOR exit nodes IP Address List | |
| IPList | Amazon AMAZON | |
| IPList | TOR relay nodes IP Address List | |
| IPList | Botnet IP Address List | |
| IPList | Malicious Site IP Address List | |
| IPList | Amazon AMAZON us-east-1 | |
| IPList | Amazon AMAZON us-west-1 | |
| IPList | Cloudflare Servers | |
| Situation | HTTP_CSU-Shared-Variables |
DISCLAIMER AND COPYRIGHT
Copyright © 2021 Forcepoint
Forcepoint and the FORCEPOINT logo are trademarks of Forcepoint.
All other trademarks used in this document are the property of their respective owners.
Every effort has been made to ensure the accuracy of this document. However, Forcepoint makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Forcepoint shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice.
Forcepoint and the FORCEPOINT logo are trademarks of Forcepoint.
All other trademarks used in this document are the property of their respective owners.
Every effort has been made to ensure the accuracy of this document. However, Forcepoint makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Forcepoint shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice.