Release notes for update package 1470-5242

This update package improves the detection capabilities of the Forcepoint LLM system.

RELEASE DATE:     Tuesday May 24, 2022
MD5 CHECKSUM:     e6ae1caf940aa8f7418465fec62228d2
SHA1 CHECKSUM:     c5245ba3d45b327e87596e2fd99bb472ef8ccd55
SHA256 CHECKSUM:     e73e5b2fede091194afb890c2daf5469be7d3aaa6a43ac08af4d700c4a62caea

UPDATE CRITICALITY:    HIGH

List of detected attacks in this update package:

Risk level Description Reference Vulnerability
High     An attempt to exploit a vulnerability in Pimcore detected     CVE-2022-1429     Pimcore-Gridhelperservice-SQL-Injection
High     An attempt to exploit a vulnerability in Eaton Intelligent Power Manager detected     CVE-2021-23282     Eaton-Intelligent-Power-Management-CVE-2021-23282-Stored-Cross-Site-Scripting

Jump to: Detected Attacks Other Changes

DETECTED ATTACKS

New detected attacks:

HTTP Normalized Request-Line

Risk Vulnerability/Situation References Related Fingerprint Situation Type
High Pimcore-Gridhelperservice-SQL-Injection CVE-2022-1429 HTTP_CRL-Pimcore-Gridhelperservice-SQL-Injection Suspected Compromise
High Eaton-Intelligent-Power-Management-CVE-2021-23282-Stored-Cross-Site-Scripting CVE-2021-23282 HTTP_CRL-Eaton-Intelligent-Power-Management-CVE-2021-23282-Stored-Cross-Site-Scripting Suspected Compromise

Updated detected attacks:

UDP Packet Unknown

Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description
High Generic-HTTP-Exploit No CVE/CAN Generic_UDP-Malicious-Packet Suspected Compromise
Description has changed
High Generic-HTTP-Exploit No CVE/CAN Generic_UDP-Suspicious-Server-Certificate Suspected Compromise
Description has changed

DNS UDP Server Message

Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description
High Generic-HTTP-Exploit No CVE/CAN DNS-UDP_Suspicious-Response Potential Compromise
Description has changed

E-Mail Header Stream

Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description
High Generic-HTTP-Exploit No CVE/CAN E-Mail_Suspicious-Header Suspected Compromise
Description has changed

HTTP Request Header Line

Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description
High Red-Hat-Directory-Server-Accept-Language-Parsing-Buffer-Overflow CVE-2008-2928 HTTP_CSH-Red-Hat-Directory-Server-Accept-Language-Parsing-Buffer-Overflow Suspected Compromise
Fingerprint regexp changed
High Apache-HTTP-Server-Mod_rpaf-X-Forwarded-For-Denial-Of-Service CVE-2012-3526 HTTP_CSH-Apache-HTTP-Server-Mod_rpaf-X-Forwarded-For-Denial-Of-Service Potential Compromise
Fingerprint regexp changed
High Lighttpd-Connection-Header-Parsing-Denial-Of-Service CVE-2012-5533 HTTP_CSH-Lighttpd-Connection-Header-Parsing-Denial-Of-Service Suspected Compromise
Fingerprint regexp changed
High Squid-Strhdracptlanggetitem-Value-Denial-Of-Service CVE-2013-1839 HTTP_CSH-Squid-Strhdracptlanggetitem-Value-Denial-Of-Service Suspected Compromise
Fingerprint regexp changed
High Apache-HTTP-Server-Mod_Proxy-Denial-Of-Service CVE-2014-0117 HTTP_CSH-Apache-HTTP-Server-Mod_Proxy-Denial-Of-Service Suspected Compromise
Fingerprint regexp changed
Critical Joomla-Remote-Code-Execution-Vulnerability CVE-2015-8562 HTTP_CSH-Joomla-Remote-Code-Execution-Vulnerability Compromise
Fingerprint regexp changed
High Apache-Httpd-Ap_Find_Token-Out-Of-Bounds-Read CVE-2017-7668 HTTP_CSH-Apache-Httpd-Ap_Find_Token-Out-Of-Bounds-Read Suspected Compromise
Fingerprint regexp changed
High HPE-Integrated-Lights-Out-CVE-2017-12542 CVE-2017-12542 HTTP_CSH-HPE-Integrated-Lights-Out-CVE-2017-12542 Suspected Compromise
Fingerprint regexp changed
High VLC-Httpd-Connection-Header-Format-String-RCE No CVE/CAN HTTP_CRH-VLC-Httpd-Connection-Header-Format-String-RCE Suspected Compromise
Fingerprint regexp changed
High Wordpress-Contact-Form-Entries-Plugin-Stored-Cross-Site-Scripting CVE-2021-25080 HTTP_CSH-Wordpress-Contact-Form-Entries-Plugin-Stored-Cross-Site-Scripting Suspected Compromise
Fingerprint regexp changed
High HP-OpenView-Network-Node-Manager-Ovalarm.exe-Accept-Language-Buffer-Overflow CVE-2009-4179 HTTP_CSH-HP-OpenView-Network-Node-Manager-Ovalarm.exe-Accept-Lang-BOF Potential Compromise
Fingerprint regexp changed

LIST OF OTHER CHANGES:

New objects:

Type Name
Element Ref Application dependency from Chrome-Remote-Desktop to Google-Hosted-Libraries
Element Ref Application dependency from Chrome-Remote-Desktop to Google
Element Ref Application dependency from Chrome-Remote-Desktop to QUIC
Element Ref Application dependency from Chrome-Remote-Desktop to STUN

Updated objects:

Type Name Changes
IPList Somalia
IPList Saudi Arabia
IPList Iran
IPList Kenya
IPList Djibouti
IPList Seychelles
IPList Kuwait
IPList Qatar
IPList Bahrain
IPList United Arab Emirates
IPList Israel
IPList Turkey
IPList Greece
IPList Estonia
IPList Latvia
IPList Lithuania
IPList Moldova
IPList Belarus
IPList Finland
IPList Ukraine
IPList Hungary
IPList Bulgaria
IPList Albania
IPList Poland
IPList Romania
IPList South Africa
IPList Mozambique
IPList Bangladesh
IPList India
IPList Myanmar
IPList Kazakhstan
IPList Vietnam
IPList Thailand
IPList Indonesia
IPList Taiwan
IPList Philippines
IPList China
IPList Hong Kong
IPList South Korea
IPList Japan
IPList Singapore
IPList Russia
IPList Australia
IPList New Zealand
IPList Portugal
IPList Equatorial Guinea
IPList Gibraltar
IPList Spain
IPList Denmark
IPList United Kingdom
IPList Switzerland
IPList Sweden
IPList Netherlands
IPList Austria
IPList Belgium
IPList Germany
IPList Luxembourg
IPList Ireland
IPList France
IPList Slovakia
IPList Czechia
IPList Norway
IPList Italy
IPList Slovenia
IPList Croatia
IPList Brazil
IPList Dominica
IPList British Virgin Islands
IPList Grenada
IPList Cayman Islands
IPList Costa Rica
IPList Colombia
IPList Argentina
IPList Chile
IPList Peru
IPList Mexico
IPList Puerto Rico
IPList Canada
IPList United States
IPList Serbia
IPList TOR exit nodes IP Address List
IPList Amazon AMAZON
IPList Amazon EC2
IPList Google Servers
IPList Microsoft Azure datacenter for australiaeast
IPList TOR relay nodes IP Address List
IPList Microsoft Azure datacenter for centralus
IPList Microsoft Azure datacenter for eastasia
IPList Microsoft Azure datacenter for eastus2
IPList Microsoft Azure datacenter for eastus
IPList Microsoft Azure datacenter for northeurope
IPList Microsoft Azure datacenter for southcentralus
IPList Microsoft Azure datacenter for southeastasia
IPList Microsoft Azure datacenter for westeurope
IPList Amazon GLOBALACCELERATOR
IPList Microsoft Azure datacenter for westus2
IPList Microsoft Azure datacenter
IPList Okta IP Address List
IPList Botnet IP Address List
IPList Malicious Site IP Address List
IPList Amazon AMAZON eu-central-1
IPList Amazon AMAZON sa-east-1
IPList Amazon AMAZON us-east-1
IPList Amazon AMAZON us-west-1
IPList Amazon AMAZON us-west-2
IPList Amazon EC2 us-west-2
IPList Zoom
IPList Microsoft Azure service for AzureArcInfrastructure
IPList Microsoft Azure service for AzureCloud
IPList Microsoft Azure service for AzureDataLake
IPList Microsoft Azure service for AzureUpdateDelivery
Situation HTTP_CSH-Shared-Variables
Fingerprint regexp changed
Situation HTTP_CSH-Novell-Groupwise-Messenger-Accept-Language-Header-Code-Execution
Description has changed
Category tag situation Obsolete added
Category tag os Any Operating System removed
Category tag hardware Any Hardware removed
Category tag application Novell GroupWise Messenger removed
Category tag group CVE2006 removed
Category tag os_not_specific Any Operating System not specific removed
Category tag situation Potential Compromise removed
Category tag group HTTP Correlation Dependency Group removed
Category tag group TCP Correlation Dependency Group removed
Category tag group Severity over 4 Correlation Dependency Group removed
Category tag group TCP Client Traffic removed
Fingerprint regexp changed
Situation HTTP_CSH-Connection-Upgrade-Request
Fingerprint regexp changed

DISCLAIMER AND COPYRIGHT

Copyright © 2022 Forcepoint
Forcepoint and the FORCEPOINT logo are trademarks of Forcepoint.

All other trademarks used in this document are the property of their respective owners.

Every effort has been made to ensure the accuracy of this document. However, Forcepoint makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Forcepoint shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice.