Release notes for update package 1430-5242

This update package improves the detection capabilities of the Forcepoint LLM system.

RELEASE DATE:     Monday January 31, 2022
MD5 CHECKSUM:     6d0a9bb6e72166be3a5fe61be32ec6da
SHA1 CHECKSUM:     e6ad285d7fa0296415e2c0d8b5fe204dad6a3763
SHA256 CHECKSUM:     dc70399ecc7902e56d8a3c45c72fdcd528f6cc9fc1dd3eba135557100b70fe24

UPDATE CRITICALITY:    HIGH

List of detected attacks in this update package:

Risk level Description Reference Vulnerability
High     An attempt to exploit a vulnerability in Cisco Internet Key Exchange version 1 detected.     CVE-2016-6415     Cisco-IKE-Information-Disclosure
High     An attempt to exploit a vulnerability in SAP Internet Graphics Servers.     CVE-2018-2392     SAP-Internet-Graphics-Server-XMLCHART-Xxe
High     An attempt to exploit a vulnerability in the Wordpress BulletProof Security plugin detected.     CVE-2021-39327     Wordpress-BulletProof-Security-Backup-Disclosure
High     An attempt to exploit a vulnerability in Jenkins Badge Plugin detected     CVE-2022-23108     Jenkins-Badge-Plugin-Stored-Cross-Site-Scripting
High     An attempt to exploit a vulnerability in SonicWall detected     CVE-2021-20039     SonicWall-Command-Injection-CVE-2021-20039
High     An attempt to exploit a vulnerability in WordPress Project WordPress detected     CVE-2022-21662     Wordpress-Core-Post-Slug-Stored-Cross-Site-Scripting

Jump to: Detected Attacks Other Changes

DETECTED ATTACKS

New detected attacks:

UDP Packet Unknown

Risk Vulnerability/Situation References Related Fingerprint Situation Type
High Cisco-IKE-Information-Disclosure CVE-2016-6415 Generic_UDP-Cisco-IKE-Information-Disclosure Suspected Compromise

HTTP Client Stream

Risk Vulnerability/Situation References Related Fingerprint Situation Type
High SAP-Internet-Graphics-Server-XMLCHART-Xxe CVE-2018-2392 HTTP_CS-SAP-Internet-Graphics-Server-XMLCHART-Xxe Suspected Compromise

HTTP Request URI

Risk Vulnerability/Situation References Related Fingerprint Situation Type
High Wordpress-BulletProof-Security-Backup-Disclosure CVE-2021-39327 HTTP_CSU-Wordpress-BulletProof-Security-Backup-Disclosure Suspected Disclosure

HTTP Normalized Request-Line

Risk Vulnerability/Situation References Related Fingerprint Situation Type
High Jenkins-Badge-Plugin-Stored-Cross-Site-Scripting CVE-2022-23108 HTTP_CRL-Jenkins-Badge-Plugin-Stored-Cross-Site-Scripting Suspected Compromise
High SonicWall-Command-Injection-CVE-2021-20039 CVE-2021-20039 HTTP_CRL-SonicWall-Command-Injection-CVE-2021-20039 Suspected Compromise
High Wordpress-Core-Post-Slug-Stored-Cross-Site-Scripting CVE-2022-21662 HTTP_CRL-Wordpress-Core-Post-Slug-Stored-Cross-Site-Scripting Suspected Compromise

Updated detected attacks:

Text File Stream

Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description
Low JavaScript-Obfuscation No CVE/CAN File-Text_Decimal-Encoded-JavaScript-2 Other Suspicious Traffic
Category tag situation Other Suspicious Traffic added
Category tag group Anomalies added
Category tag situation Possibly Unwanted Content removed
Low JSFuck-JavaScript-Obfuscation No CVE/CAN File-Text_JSFuck-JavaScript-Obfuscation Other Suspicious Traffic
Severity: 7->2
Category tag situation Other Suspicious Traffic added
Category tag group Anomalies added
Category tag situation Suspected Compromise removed
Category tag group Severity over 4 Correlation Dependency Group removed
Low JavaScript-Obfuscation No CVE/CAN File-Text_Jfogs-Obfuscated-JavaScript-Detected Other Suspicious Traffic
Severity: 7->2
Category tag situation Other Suspicious Traffic added
Category tag situation Suspected Attack Related Anomalies removed
Category tag group Severity over 4 Correlation Dependency Group removed
Low JavaScript-Obfuscation No CVE/CAN File-Text_Jjencode-Obfuscated-JavaScript-Detected Other Suspicious Traffic
Severity: 7->2
Category tag situation Other Suspicious Traffic added
Category tag situation Suspected Attack Related Anomalies removed
Category tag group Severity over 4 Correlation Dependency Group removed
Low JavaScript-Obfuscation No CVE/CAN File-Text_JavaScript-FromCharCode-Obfuscation-Detected-2 Other Suspicious Traffic
Severity: 7->2
Category tag situation Other Suspicious Traffic added
Category tag situation Suspected Attack Related Anomalies removed
Category tag group Severity over 4 Correlation Dependency Group removed
High Apache-Mod-Include-Buffer-Overflow CVE-2004-0940 File-Text_Apache-Mod-Include-Buffer-Overflow Suspected Compromise
Fingerprint regexp changed
Low JavaScript-Obfuscation No CVE/CAN File-Text_JavaScript-String-Value-Obfuscation Other Suspicious Traffic
Severity: 7->2
Category tag situation Other Suspicious Traffic added
Category tag situation Suspected Attack Related Anomalies removed
Category tag group Severity over 4 Correlation Dependency Group removed
Low JavaScript-Obfuscation No CVE/CAN File-Text_JavaScript-Obfuscation-Method-Detected Other Suspicious Traffic
Severity: 7->2
Category tag situation Other Suspicious Traffic added
Category tag group Anomalies added
Category tag situation Suspected Compromise removed
Category tag group Severity over 4 Correlation Dependency Group removed

LIST OF OTHER CHANGES:

New objects:

Type Name
Category Jenkins Badge Plugin
Category Wordpress BulletProof Security
Category Cisco IKE
Category SAP Internet Graphics Server
Situation TCP_Option-Unhandled

Updated objects:

Type Name Changes
IPList Yemen
IPList Iraq
IPList Saudi Arabia
IPList Iran
IPList Cyprus
IPList Armenia
IPList Kenya
IPList Seychelles
IPList Jordan
IPList Lebanon
IPList Kuwait
IPList Oman
IPList Qatar
IPList Bahrain
IPList United Arab Emirates
IPList Israel
IPList Turkey
IPList Ethiopia
IPList Egypt
IPList Greece
IPList Estonia
IPList Latvia
IPList Azerbaijan
IPList Lithuania
IPList Georgia
IPList Moldova
IPList Belarus
IPList Finland
IPList Åland
IPList Ukraine
IPList Hungary
IPList Bulgaria
IPList Albania
IPList Poland
IPList Romania
IPList Kosovo
IPList Zimbabwe
IPList Lesotho
IPList Botswana
IPList South Africa
IPList Afghanistan
IPList Pakistan
IPList Bangladesh
IPList Turkmenistan
IPList Sri Lanka
IPList Bhutan
IPList India
IPList Nepal
IPList Myanmar
IPList Uzbekistan
IPList Kazakhstan
IPList Vietnam
IPList Thailand
IPList Indonesia
IPList Taiwan
IPList Philippines
IPList Malaysia
IPList China
IPList Hong Kong
IPList Cambodia
IPList South Korea
IPList Japan
IPList North Korea
IPList Singapore
IPList Russia
IPList Mongolia
IPList Australia
IPList Norfolk Island
IPList New Zealand
IPList Portugal
IPList Ghana
IPList Nigeria
IPList Burkina Faso
IPList Mauritania
IPList Sierra Leone
IPList Gibraltar
IPList Gambia
IPList Chad
IPList Niger
IPList Tunisia
IPList Spain
IPList Algeria
IPList Denmark
IPList Iceland
IPList United Kingdom
IPList Switzerland
IPList Sweden
IPList Netherlands
IPList Austria
IPList Belgium
IPList Germany
IPList Luxembourg
IPList Ireland
IPList Monaco
IPList France
IPList Andorra
IPList Liechtenstein
IPList Jersey
IPList Slovakia
IPList Czechia
IPList Norway
IPList Italy
IPList Slovenia
IPList Croatia
IPList Barbados
IPList Paraguay
IPList Brazil
IPList Falkland Islands
IPList Jamaica
IPList Dominican Republic
IPList Martinique
IPList Bahamas
IPList Anguilla
IPList St Kitts and Nevis
IPList Antigua and Barbuda
IPList Saint Lucia
IPList Turks and Caicos Islands
IPList British Virgin Islands
IPList Montserrat
IPList Guadeloupe
IPList Grenada
IPList Cayman Islands
IPList Belize
IPList El Salvador
IPList Guatemala
IPList Honduras
IPList Costa Rica
IPList Venezuela
IPList Ecuador
IPList Colombia
IPList Panama
IPList Argentina
IPList Chile
IPList Bolivia
IPList Peru
IPList Mexico
IPList Guam
IPList Puerto Rico
IPList U.S. Virgin Islands
IPList Canada
IPList United States
IPList Serbia
IPList Sint Maarten
IPList Curaçao
IPList TOR exit nodes IP Address List
IPList Amazon AMAZON
IPList Google Servers
IPList TOR relay nodes IP Address List
IPList Microsoft Office 365 SharePoint Online and OneDrive for Business
IPList Botnet IP Address List
IPList Malicious Site IP Address List
IPList Amazon AMAZON ap-southeast-2
IPList Amazon AMAZON ap-southeast-3
Situation TCP_Option-Unsupported
Description has changed
Situation File-Text_Soft-Hyphen-Obfuscation
Severity: 7->2
Category tag situation Other Suspicious Traffic added
Category tag group Anomalies added
Category tag situation Attack Related Anomalies removed
Category tag group Severity over 4 Correlation Dependency Group removed
Situation File-Text_Obfuscated-Evaluated-Script-Content
Severity: 7->2
Category tag situation Other Suspicious Traffic added
Category tag situation Suspected Attack Related Anomalies removed
Category tag group Severity over 4 Correlation Dependency Group removed
User Response Default User Response

DISCLAIMER AND COPYRIGHT

Copyright © 2022 Forcepoint
Forcepoint and the FORCEPOINT logo are trademarks of Forcepoint.

All other trademarks used in this document are the property of their respective owners.

Every effort has been made to ensure the accuracy of this document. However, Forcepoint makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Forcepoint shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice.