Release notes for update package 1406-5242

Rolling DFA upgrades

Starting from dynamic update 1393, the handling of situations appearing in multiple contexts is improved. To avoid the same traffic data to be matched against multiple DFA's, all DFA's are being modified. When large number of DFAs change at the same time, the temporary memory requirement during a policy installation or refresh increases. To avoid not enough available memory on low end NGFW appliances these changes on DFA's are implemented gradually over the course of 10 dynamic update packages. With low end NGFW appliances, especially N110 and N115, it is recommended to upgrade to NGFW version 6.8.2 or higher to better address new policy when there is not enough memory for both old and new policy. A large number of DFAs might change at the same time if there is a large gap between activating dynamic update packages and the subsequent policy refresh.

See knowledge base article 18570.

This update package improves the detection capabilities of the Forcepoint LLM system.

RELEASE DATE:     Monday November 22, 2021
MD5 CHECKSUM:     4ca9e241066ac71a5fa2215f0810027d
SHA1 CHECKSUM:     7222d551621b1d5a6ac0c4d04a784d99230d48f3
SHA256 CHECKSUM:     f6c1eb5072eab4440d12a62f9eb6dad9f2ff60701355195688bc3c41d11450dd

UPDATE CRITICALITY:    HIGH

List of detected attacks in this update package:

Risk level Description Reference Vulnerability
High     An attempt to exploit a vulnerability in Nagios XI detected.     CVE-2021-40344     Nagios-XI-Custom-Includes-Component-Arbitrary-File-Upload
High     An attempt to exploit a vulnerability in Wordpress Plugin Duplicator detected     CVE-2020-11738     Wordpress-Plugin-Duplicator-Arbitrary-File-Read
High     An attempt to exploit a vulnerability in Cisco Wireless IP Phone detected     CVE-2020-3161     Cisco-Wireless-IP-Phone-Stack-Based-Buffer-Overflow
High     An attempt to exploit a vulnerability in Cisco Adaptive Security Appliance detected     CVE-2020-3452     Cisco-Adaptive-Security-Appliance-Unauthenticated-File-Read
High     An attempt to exploit a vulnerability in IBM Data Risk Manager detected     CVE-2020-4427     IBM-Data-Risk-Manager-Authentication-Bypass
High     An attempt to exploit a vulnerability in Google Chrome detected     CVE-2021-37975     Google-Chrome-Use-After-Free-CVE-2021-37975
High     An attempt to exploit a vulnerability in Chromium detected     CVE-2020-16009     Chromium-V8-Turbofan-Type-Confusion
High     An attempt to exploit a vulnerability in SmarterTools SmarterMail detected     CVE-2021-35519     Smartertools-Smartermail-Message-Onerror-Stored-Cross-Site-Scripting
High     An attempt to exploit a vulnerability in ZyXEL detected     CVE-2020-29583     ZyXEL-Undocumented-User-Credentials
High     An attempt to exploit a vulnerability in Chrome detected     CVE-2021-30551     Google-Chrome-V8-Type-Confusion-CVE-2021-30551
High     An attempt to exploit a vulnerability in Sophos XG Firewall detected     CVE-2020-12271     Sophos-XG-Firewall-Pre-Auth-SQL-Injection
High     An attempt to exploit a vulnerability in Tenda AC11 detected     CVE-2021-31755     Tenda-AC11-Remote-Code-Execution-CVE-2021-31755
High     An attempt to exploit a vulnerability in IBM TM1 Planning Analytics detected     CVE-2019-4716     IBM-TM1-Planning-Analytics-Remote-Code-Execution
High     An attempt to exploit a vulnerability in Delta Industrial Automation DOPSoft.     CVE-2021-38402     Delta-Industrial-Automation-DOPSoft-DPS-Stack-Buffer-Overflow
High     An attempt to exploit a vulnerability in Safari detected     CVE-2020-27930     Safari-Stack-Based-Out-Of-Bounds
High     An attempt to exploit a vulnerability in Microsoft Exchange detected     CVE-2021-42321     Microsoft-Exchange-Deserialization-Remote-Code-Execution

Jump to: Detected Attacks Other Changes

DETECTED ATTACKS

New detected attacks:

HTTP Client Stream

Risk Vulnerability/Situation References Related Fingerprint Situation Type
High Nagios-XI-Custom-Includes-Component-Arbitrary-File-Upload CVE-2021-40344 HTTP_CS-Nagios-XI-Custom-Includes-Component-Arbitrary-File-Upload Suspected Compromise

TCP Client Stream Unknown

Risk Vulnerability/Situation References Related Fingerprint Situation Type
High IBM-TM1-Planning-Analytics-Remote-Code-Execution CVE-2019-4716 Generic_TCP-IBM-TM1-Planning-Analytics-Remote-Code-Execution Suspected Compromise

HTTP Request URI

Risk Vulnerability/Situation References Related Fingerprint Situation Type
High Wordpress-Plugin-Duplicator-Arbitrary-File-Read CVE-2020-11738 HTTP_CSU-Wordpress-Plugin-Duplicator-Arbitrary-File-Read Suspected Compromise
High Cisco-Wireless-IP-Phone-Stack-Based-Buffer-Overflow CVE-2020-3161 HTTP_CSU-Cisco-Wireless-IP-Phone-Stack-Based-Buffer-Overflow Suspected Compromise
High Cisco-Adaptive-Security-Appliance-Unauthenticated-File-Read CVE-2020-3452 HTTP_CSU-Cisco-Adaptive-Security-Appliance-Unauthenticated-File-Read Suspected Compromise
High IBM-Data-Risk-Manager-Authentication-Bypass CVE-2020-4427 HTTP_CSU-IBM-Data-Risk-Manager-Authentication-Bypass Suspected Compromise

HTTP Normalized Request-Line

Risk Vulnerability/Situation References Related Fingerprint Situation Type
High Sophos-XG-Firewall-Pre-Auth-SQL-Injection CVE-2020-12271 HTTP_CRL-Sophos-XG-Firewall-Pre-Auth-SQL-Injection Suspected Compromise
High Tenda-AC11-Remote-Code-Execution-CVE-2021-31755 CVE-2021-31755 HTTP_CRL-Tenda-AC11-Remote-Code-Execution-CVE-2021-31755 Suspected Compromise

Text File Stream

Risk Vulnerability/Situation References Related Fingerprint Situation Type
High Google-Chrome-Use-After-Free-CVE-2021-37975 CVE-2021-37975 File-Text_Google-Chrome-Use-After-Free-CVE-2021-37975 Suspected Compromise
High Chromium-V8-Turbofan-Type-Confusion CVE-2020-16009 File-Text_Chromium-V8-Turbofan-Type-Confusion Suspected Compromise
High Smartertools-Smartermail-Message-Onerror-Stored-Cross-Site-Scripting CVE-2021-35519 File-Text_Smartertools-Smartermail-Message-Onerror-Stored-Cross-Site-Scripting Suspected Compromise
High ZyXEL-Undocumented-User-Credentials CVE-2020-29583 File-Text_ZyXEL-Undocumented-User-Credentials Suspected Compromise
High Google-Chrome-V8-Type-Confusion-CVE-2021-30551 CVE-2021-30551 File-Text_Google-Chrome-V8-Type-Confusion-CVE-2021-30551 Suspected Compromise

Other Binary File Stream

Risk Vulnerability/Situation References Related Fingerprint Situation Type
High Delta-Industrial-Automation-DOPSoft-DPS-Stack-Buffer-Overflow CVE-2021-38402 File-Binary_Delta-Industrial-Automation-DOPSoft-DPS-Stack-Buffer-Overflow Suspected Compromise

Identified Text File Stream

Risk Vulnerability/Situation References Related Fingerprint Situation Type
High Safari-Stack-Based-Out-Of-Bounds CVE-2020-27930 File-TextId_Safari-Stack-Based-Out-Of-Bounds Suspected Compromise
High Microsoft-Exchange-Deserialization-Remote-Code-Execution CVE-2021-42321 File-TextId_Microsoft-Exchange-Deserialization-Remote-Code-Execution Suspected Compromise

Updated detected attacks:

DNS UDP Server Message

Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description
High Exim-DKIM-DNS-Decoding-Buffer-Overflow CVE-2012-5671 DNS-UDP_Exim-DKIM-DNS-Decoding-Buffer-Overflow Potential Compromise
Fingerprint regexp changed

DNS TCP Server Stream

Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description
High Exim-DKIM-DNS-Decoding-Buffer-Overflow CVE-2012-5671 DNS-TCP_Exim-DKIM-DNS-Decoding-Buffer-Overflow Potential Compromise
Fingerprint regexp changed

FTP Download Stream

Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description
Low Executable-File-Transfer No CVE/CAN FTP_DL-Executable-File-Download Possibly Unwanted Content
Fingerprint regexp changed

FTP Upload Stream

Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description
Low Executable-File-Transfer No CVE/CAN FTP_UL-Executable-File-Upload Possibly Unwanted Content
Fingerprint regexp changed

HTTP Normalized Request-Line

Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description
High CA-ARCserve-D2D-Axis2-Default-Credentials No CVE/CAN HTTP_CRL-Apache-Axis2-Default-Credentials Suspected Compromise
Fingerprint regexp changed
High Unraid-Auth-Bypass-PHP-RCE CVE-2020-5847 HTTP_CRL-Unraid-Auth-Bypass-PHP-RCE Suspected Compromise
Detection mechanism updated
High SaltStack-Salt-Salt.wheel.pillar_roots.write-Method-Directory-Traversal CVE-2021-25282 HTTP_CRL-SaltStack-Salt-Salt.wheel.pillar_roots.write-Method-Directory-Traversal Suspected Compromise
Fingerprint regexp changed

LIST OF OTHER CHANGES:

New objects:

Type Name
Category Sophos XG Firewall
Category SmarterTools SmarterMail
Category Delta Industrial Automation DOPSoft
Category IBM TM1
Category ZyXEL
Situation TCP_Segment-Unexpected-ACK

Updated objects:

Type Name Changes
IPList TOR exit nodes IP Address List
IPList Amazon AMAZON
IPList TOR relay nodes IP Address List
IPList Netflix Servers
IPList Salesforce APNIC
IPList Salesforce
IPList Salesforce RIPE
IPList Amazon AMAZON ap-east-1
IPList Amazon AMAZON ap-northeast-1
IPList Amazon AMAZON ap-northeast-2
IPList Amazon AMAZON ap-northeast-3
IPList Botnet IP Address List
IPList Malicious Site IP Address List
IPList Amazon AMAZON ap-south-1
IPList Amazon AMAZON ap-southeast-1
IPList Amazon AMAZON ap-southeast-2
IPList Amazon AMAZON ca-central-1
IPList Amazon AMAZON cn-north-1
IPList Amazon AMAZON cn-northwest-1
IPList Amazon AMAZON eu-central-1
IPList Amazon AMAZON eu-north-1
IPList Amazon AMAZON eu-west-1
IPList Amazon AMAZON eu-west-2
IPList Amazon AMAZON eu-west-3
IPList Amazon AMAZON me-south-1
IPList Amazon AMAZON sa-east-1
IPList Amazon AMAZON us-east-1
IPList Amazon AMAZON us-east-2
IPList Amazon AMAZON us-west-1
IPList Amazon AMAZON us-west-2
IPList Amazon AMAZON eu-south-1
IPList Salesforce LACNIC
Situation TCP_Segment-Unexpected-ACK-In-Loose-Mode
Name: TCP_Segment-ACK-Unacceptable->TCP_Segment-Unexpected-ACK-In-Loose-Mode
Comment has changed
Description has changed
Situation HTTP_SHS-Compressed-HTTP-Response
Description has changed
Category tag situation Obsolete added
Category tag os Windows removed
Category tag hardware x86 removed
Category tag application Internet Explorer removed
Category tag group CVE2006 removed
Category tag os_not_specific Windows not specific removed
Category tag application_not_specific Internet Explorer not specific removed
Category tag situation Protocol Information removed
Category tag group TCP Server Traffic removed
Situation HTTP_CSU-Long-HTTP-Request-URI
Description has changed
Category tag situation Obsolete added
Category tag os Windows removed
Category tag hardware Any Hardware removed
Category tag application Internet Explorer removed
Category tag group CVE2006 removed
Category tag os_not_specific Windows not specific removed
Category tag application_not_specific Internet Explorer not specific removed
Category tag situation System Inspections removed
Category tag group HTTP Correlation Dependency Group removed
Category tag group TCP Correlation Dependency Group removed
Category tag group TCP Client Traffic removed
Fingerprint regexp changed
Situation HTTP_SHS-Microsoft-Internet-Explorer-Compressed-Content-URL-Buffer-Overflow
Description has changed
Category tag situation Obsolete added
Category tag os Windows removed
Category tag hardware x86 removed
Category tag application Internet Explorer 6.0 removed
Category tag group CVE2006 removed
Category tag os_not_specific Windows not specific removed
Category tag situation Potential Compromise removed
Category tag group HTTP Correlation Dependency Group removed
Category tag group TCP Correlation Dependency Group removed
Category tag group Severity over 4 Correlation Dependency Group removed
Category tag group TCP Server Traffic removed
Situation SMTP_Shared-Variables-For-Server-Stream-Context
Fingerprint regexp changed

DISCLAIMER AND COPYRIGHT

Copyright © 2021 Forcepoint
Forcepoint and the FORCEPOINT logo are trademarks of Forcepoint.

All other trademarks used in this document are the property of their respective owners.

Every effort has been made to ensure the accuracy of this document. However, Forcepoint makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Forcepoint shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice.