Release notes for update package 1721-5242

This update package improves the detection capabilities of the Forcepoint LLM system.

RELEASE DATE:     Thursday May 02, 2024
MD5 CHECKSUM:     baa8d9ce3f4231605c83b4e861e3f214
SHA1 CHECKSUM:     e75e60ec7610d2a718691dadff116d1feed08cef
SHA256 CHECKSUM:     7c0fe57f6029ad82fe57645172d928be4aff6f4987a304971e8c8ac05a6775de


UPDATE CRITICALITY:    HIGH

List of detected attacks in this update package:

Risk level Description Reference Vulnerability
High     An attempt to exploit a vulnerability in pgAdmin detected     CVE-2024-3116     Pgadmin-Validate_Binary_Path-CVE-2024-3116-Remote-Code-Execution

Jump to: Detected Attacks Other Changes

DETECTED ATTACKS

New detected attacks:

HTTP Normalized Request-Line

Risk Vulnerability/Situation References Related Fingerprint Situation Type
High Pgadmin-Validate_Binary_Path-CVE-2024-3116-Remote-Code-Execution CVE-2024-3116 HTTP_CRL-Pgadmin-Validate_Binary_Path-CVE-2024-3116-Remote-Code-Execution Potential Compromise

Updated detected attacks:

HTTP Client Stream

Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description
High Vtiger-Install-Module-Remote-Command-Execution CVE-2014-2268 HTTP_CS-Vtiger-Install-Module-Remote-Command-Execution Suspected Compromise
Fingerprint regexp changed
High Eir-D1000-Wireless-Router-WAN-Side-Remote-Command-Injection No CVE/CAN HTTP_CS-Eir-D1000-Wireless-Router-WAN-Side-Remote-Command-Injection Suspected Compromise
Detection mechanism updated
High HPE-Intelligent-Management-Center-Mibfileservlet-File-Directory-Traversal CVE-2017-12559 HTTP_CS-HPE-Intelligent-Management-Center-Mibfileservlet-File-Directory-Traversal Suspected Compromise
Fingerprint regexp changed
High NetGear-DGN2200-dnslookup.cgi-Command-Injection CVE-2017-6334 HTTP_CS-NetGear-DGN2200-dnslookup.cgi-Command-Injection Suspected Compromise
Fingerprint regexp changed
High Zoho-Manageengine-Servicedesk-Plus-CVE-2021-37415-Authentication-Bypass CVE-2021-37415 HTTP_CS-Zoho-Manageengine-Servicedesk-Plus-CVE-2021-37415-Authentication-Bypass Suspected Compromise
Fingerprint regexp changed
High Apache-Kylin-Rest-API-Admin-Configuration-Information-Disclosure CVE-2020-13937 HTTP_CS-Apache-Kylin-Rest-API-Admin-Configuration-Information-Disclosure Suspected Compromise
Fingerprint regexp changed
High PRTG-CVE-2023-32781-Authenticated-RCE CVE-2023-32781 HTTP_CS-PRTG-CVE-2023-32781-Authenticated-RCE Suspected Compromise
Fingerprint regexp changed
High Supervene-RazDC-Create-User-Code-Injection CVE-2018-15551 HTTP_CS-Supervene-RazDC-Create-User-Code-Injection Suspected Compromise
Fingerprint regexp changed
High Supervene-RazDC-Reset-Password-Code-Injection CVE-2018-15549 HTTP_CS-Supervene-RazDC-Reset-Password-Code-Injection Suspected Compromise
Fingerprint regexp changed

HTTP Normalized Request-Line

Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description
High Pgadmin-Validate_Binary_Path-Remote-Code-Execution CVE-2022-4223 HTTP_CRL-Pgadmin-Validate_Binary_Path-Remote-Code-Execution Suspected Compromise
Fingerprint regexp changed

LIST OF OTHER CHANGES:

Updated objects:

Type Name Changes
Situation URL_List-DNS-Over-HTTPS
Detection mechanism updated
IPList Iraq
IPList Saudi Arabia
IPList Iran
IPList Cyprus
IPList Tanzania
IPList Armenia
IPList Kenya
IPList Seychelles
IPList Jordan
IPList Lebanon
IPList Oman
IPList Qatar
IPList Bahrain
IPList United Arab Emirates
IPList Israel
IPList Türkiye
IPList Egypt
IPList Greece
IPList Estonia
IPList Latvia
IPList Azerbaijan
IPList Lithuania
IPList Georgia
IPList Moldova
IPList Belarus
IPList Finland
IPList Ukraine
IPList North Macedonia
IPList Hungary
IPList Bulgaria
IPList Albania
IPList Poland
IPList Romania
IPList Mauritius
IPList South Africa
IPList Pakistan
IPList Bangladesh
IPList Turkmenistan
IPList Sri Lanka
IPList Bhutan
IPList India
IPList Nepal
IPList Myanmar
IPList Uzbekistan
IPList Kazakhstan
IPList Kyrgyzstan
IPList Vietnam
IPList Thailand
IPList Indonesia
IPList Taiwan
IPList Philippines
IPList Malaysia
IPList China
IPList Hong Kong
IPList Brunei
IPList Macao
IPList Cambodia
IPList South Korea
IPList Japan
IPList North Korea
IPList Singapore
IPList Russia
IPList Mongolia
IPList Australia
IPList Papua New Guinea
IPList New Zealand
IPList Libya
IPList Cameroon
IPList Portugal
IPList Ivory Coast
IPList Gibraltar
IPList Spain
IPList Malta
IPList Algeria
IPList Denmark
IPList Iceland
IPList United Kingdom
IPList Switzerland
IPList Sweden
IPList The Netherlands
IPList Austria
IPList Belgium
IPList Germany
IPList Luxembourg
IPList Ireland
IPList Monaco
IPList France
IPList Andorra
IPList Liechtenstein
IPList Jersey
IPList Isle of Man
IPList Slovakia
IPList Czechia
IPList Norway
IPList Vatican City
IPList Italy
IPList Slovenia
IPList Montenegro
IPList Croatia
IPList Bosnia and Herzegovina
IPList Guyana
IPList Paraguay
IPList Uruguay
IPList Brazil
IPList Dominican Republic
IPList Bahamas
IPList Bermuda
IPList Trinidad and Tobago
IPList St Kitts and Nevis
IPList British Virgin Islands
IPList El Salvador
IPList Guatemala
IPList Honduras
IPList Nicaragua
IPList Costa Rica
IPList Venezuela
IPList Ecuador
IPList Colombia
IPList Panama
IPList Argentina
IPList Chile
IPList Bolivia
IPList Peru
IPList Mexico
IPList Canada
IPList United States
IPList Palestine
IPList Serbia
IPList Antarctica
IPList Curaçao
IPList TOR exit nodes IP Address List
IPList Amazon AMAZON
IPList TOR relay nodes IP Address List
IPList Amazon AMAZON ap-northeast-1
IPList Malicious Site IP Address List
IPList NordVPN Servers IP Address List
IPList Forcepoint Drop IP Address List
IPList Amazon AMAZON us-west-2
Application TOR
Application DNS-Over-HTTPS
Application NordVPN

DISCLAIMER AND COPYRIGHT

Copyright © 2024 Forcepoint
Forcepoint and the FORCEPOINT logo are trademarks of Forcepoint.

All other trademarks used in this document are the property of their respective owners.

Every effort has been made to ensure the accuracy of this document. However, Forcepoint makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Forcepoint shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice.