Release notes for update package 1822-5242

This update package improves the detection capabilities of the Forcepoint LLM system.

RELEASE DATE:     Friday January 10, 2025
MD5 CHECKSUM:     e9b6d2d9d0c4af600e4f62deaff80065
SHA1 CHECKSUM:     d67774836ceace72ae153ac6659b12edd589c9f0
SHA256 CHECKSUM:     df604bc0d9b581cb6ba1376b0342c53a0b70fd204e41e4a5766153813a2e9f14


UPDATE CRITICALITY:    HIGH

List of detected attacks in this update package:

Risk level Description Reference Vulnerability
High     An attempt to exploit a vulnerability in Cacti Group Cacti detected     CVE-2024-43364     Cacti-Links.php-Title-Stored-Cross-Site-Scripting
High     An attempt to exploit a vulnerability in Microsoft Windows detected     CVE-2024-38140     Microsoft-Windows-Pragmatic-General-Multicast-Allocatedatabuffer-Use-After-Free
High     An attempt to exploit a vulnerability in Linux Kernel detected     CVE-2024-36886     Linux-Kernel-TIPC-Fragment-Handling-Use-After-Free-CVE-2024-36886
High     An attempt to exploit a vulnerability in Ivanti Endpoint Manager detected     CVE-2024-34779     Ivanti-Endpoint-Manager-Servermemory-Loadmoduletable-SQL-Injection
High     An attempt to exploit a vulnerability in Ivanti Endpoint Manager detected     CVE-2024-32848     Ivanti-Endpoint-Manager-Serverasset-Updateassetinfo-SQL-Injection
High     An attempt to exploit a vulnerability in Palo Alto Expedition     CVE-2024-9463     Palo-Alto-Expedition-Command-Injection-CVE-2024-9463
High     An attempt to exploit a vulnerability in VICIdial detected     CVE-2024-8504     VICIDIAL-Authenticated-Remote-Code-Execution
High     An attempt to exploit a vulnerability in OpenNMS detected     CVE-2023-40315     OpenNMS-Privilege-Escalation-CVE-2023-40315
High     An attempt to exploit a vulnerability in OpenNMS detected     CVE-2023-40315     OpenNMS-Privilege-Escalation-CVE-2023-40315
High     An attempt to exploit a vulnerability in Selenium Grid detected     CVE-2022-28108     Selenium-Chrome-RCE
High     An attempt to exploit a vulnerability in Cisco IOS detected     CVE-2017-6736     Cisco-IOS-And-IOS-XE-Buffer-Overflow-CVE-2017-6736

Jump to: Detected Attacks Other Changes

DETECTED ATTACKS

New detected attacks:

UDP Packet Unknown

Risk Vulnerability/Situation References Related Fingerprint Situation Type
High Linux-Kernel-TIPC-Fragment-Handling-Use-After-Free-CVE-2024-36886 CVE-2024-36886 Generic_UDP-Linux-Kernel-TIPC-Fragment-Handling-Use-After-Free-CVE-2024-36886 Potential Compromise

HTTP Request URI

Risk Vulnerability/Situation References Related Fingerprint Situation Type
High Ivanti-Endpoint-Manager-Servermemory-Loadmoduletable-SQL-Injection CVE-2024-34779 HTTP_CSU-Ivanti-Endpoint-Manager-Servermemory-Loadmoduletable-SQL-Injection Suspected Compromise

SNMP UDP Client Stream

Risk Vulnerability/Situation References Related Fingerprint Situation Type
High Cisco-IOS-And-IOS-XE-Buffer-Overflow-CVE-2017-6736 CVE-2017-6736 SNMP-UDP_Cisco-IOS-And-IOS-XE-Buffer-Overflow-CVE-2017-6736 Potential Compromise

HTTP Normalized Request-Line

Risk Vulnerability/Situation References Related Fingerprint Situation Type
High VICIDIAL-Authenticated-Remote-Code-Execution CVE-2024-8504 HTTP_CRL-VICIDIAL-Authenticated-Remote-Code-Execution Suspected Compromise
High Selenium-Chrome-RCE CVE-2022-28108 HTTP_CRL-Selenium-Chrome-RCE Suspected Compromise
High Ivanti-Endpoint-Manager-Serverasset-Updateassetinfo-SQL-Injection CVE-2024-32848 HTTP_CRL-Ivanti-Endpoint-Manager-Serverasset-Updateassetinfo-SQL-Injection Suspected Compromise
High Cacti-Links.php-Title-Stored-Cross-Site-Scripting CVE-2024-43364 HTTP_CRL-Cacti-Links.php-Title-Stored-Cross-Site-Scripting Suspected Compromise
High Palo-Alto-Expedition-Command-Injection-CVE-2024-9463 CVE-2024-9463 HTTP_CRL-Palo-Alto-Expedition-Command-Injection-CVE-2024-9463 Potential Compromise

Text File Stream

Risk Vulnerability/Situation References Related Fingerprint Situation Type
High OpenNMS-Privilege-Escalation-CVE-2023-40315 CVE-2023-40315 File-Text_OpenNMS-Authenticated-Remote-Code-Execution Suspected Compromise

Identified Text File Stream

Risk Vulnerability/Situation References Related Fingerprint Situation Type
High OpenNMS-Privilege-Escalation-CVE-2023-40315 CVE-2023-40315 File-TextId_OpenNMS-Authenticated-Remote-Code-Execution Suspected Compromise

Generic IP Fingerprinting Stream

Risk Vulnerability/Situation References Related Fingerprint Situation Type
High Microsoft-Windows-Pragmatic-General-Multicast-Allocatedatabuffer-Use-After-Free CVE-2024-38140 IPv4_Microsoft-Windows-Pragmatic-General-Multicast-Allocatedatabuffer-Use-After-Free Suspected Compromise

Updated detected attacks:

HTTP Client Stream

Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description
High Oracle-WebLogic-Server-Workcontextxmlinputadapter-Insecure-Deserialization CVE-2017-10271 HTTP_CS-Oracle-WebLogic-Server-Workcontextxmlinputadapter-Insecure-Deserialization Suspected Compromise
Description has changed
High Cyberpanel-Remote-Code-Execution-CVE-2024-51567 CVE-2024-51567 HTTP_CS-Cyberpanel-Getresetstatus-Command-Injection Suspected Compromise
Name: HTTP_CS-Cyberpanel-Remote-Code-Execution-CVE-2024-51567->HTTP_CS-Cyberpanel-Getresetstatus-Command-Injection
Fingerprint regexp changed

TCP Client Stream Unknown

Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description
High Ysoserial-Generated-Java-Serialized-Object No CVE/CAN Generic_CS-Suspicious-Java-Serialized-Object Suspected Compromise
Description has changed
Category tag group CVE2016 added
High Ivanti-Avalanche-Wlavalancheservice.exe-Type-101-102-Null-Pointer-Dereference CVE-2024-47007 Generic_CS-Ivanti-Avalanche-Wlavalancheservice.exe-Type-101-102-Null-Pointer-Dereference Suspected Compromise
Description has changed

HTTP Request URI

Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description
High NetGear-R7000-And-R6400-Cgi-Bin-Command-Injection CVE-2016-6277 HTTP_CSU-Cgi-Bin-Command-Injection Suspected Compromise
Fingerprint regexp changed
High D-Link-DSL-2750B-Command-Injection CVE-2016-20017 HTTP_CSU-D-Link-DSL-2750B-Command-Injection Suspected Compromise
Fingerprint regexp changed
High Ray-OS-Command-Injection-Via-Format-Parameter-CVE-2023-6019 CVE-2023-6019 HTTP_CSU-Ray-OS-Command-Injection-Via-Format-Parameter-CVE-2023-6019 Suspected Compromise
Fingerprint regexp changed

HTTP Request Header Line

Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description
High D-Link-HNAP-SOAPAction-Header-Command-Execution CVE-2015-2051 HTTP_CSH-D-Link-HNAP-SOAPAction-Header-Command-Execution Suspected Compromise
Fingerprint regexp changed

HTTP Normalized Request-Line

Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description
High Geutebruck-Multiple-RCE-CVE-2021-335xx CVE-2021-33543 HTTP_CRL-Geutebruck-Multiple-RCE-CVE-2021-335xx Suspected Compromise
Fingerprint regexp changed
High Roundcube-Webmail-RCE-Via-Config-Setting-CVE-2020-12641 CVE-2020-12641 HTTP_CRL-Roundcube-Webmail-ECE-Via-Config-Setting-CVE-2020-12641 Suspected Compromise
Fingerprint regexp changed
High LG-N1A1-NAS-Remote-Command-Execution-CVE-2018-14839 CVE-2018-14839 HTTP_CRL-LG-N1A1-NAS-Remote-Command-Execution-CVE-2018-14839 Suspected Compromise
Fingerprint regexp changed
High Sunhillo-Sureline-Command-Injection-CVE-2021-36380 CVE-2021-36380 HTTP_CRL-Sunhillo-Sureline-Command-Injection-CVE-2021-36380 Suspected Compromise
Fingerprint regexp changed
High Korenix-Jetwave-Command-Injection-CVE-2023-23294 CVE-2023-23294 HTTP_CRL-Korenix-Jetwave-Command-Injection-CVE-2023-23294 Suspected Compromise
Fingerprint regexp changed
High VMware-SD-WAN-Edge-Command-Injection-Vulnerability-CVE-2018-6961 CVE-2018-6961 HTTP_CRL-VMware-SD-WAN-Edge-Command-Injection-Vulnerability-CVE-2018-6961 Suspected Compromise
Fingerprint regexp changed
High Netgate-Pfsense-Command-Injection-CVE-2023-42326 CVE-2023-42326 HTTP_CRL-Netgate-Pfsense-Command-Injection-CVE-2023-42326 Suspected Compromise
Fingerprint regexp changed
High FXC-AE1021PE-Router-Command-Injection-CVE-2023-49897 CVE-2023-49897 HTTP_CRL-FXC-AE1021PE-Router-Command-Injection-CVE-2023-49897 Suspected Compromise
Fingerprint regexp changed
High LB-Link-Command-Injection-CVE-2023-26801 CVE-2023-26801 HTTP_CRL-LB-Link-Command-Injection-CVE-2023-26801 Suspected Compromise
Fingerprint regexp changed
High Avtech-IP-Camera-AVM1203-Command-Injection-CVE-2024-7029 CVE-2024-7029 HTTP_CRL-Avtech-IP-Camera-AVM1203-Command-Injection-CVE-2024-7029 Suspected Compromise
Fingerprint regexp changed
High Avtech-IP-Camera-Multiple-Command-Injection-Vulnerabilities No CVE/CAN HTTP_CRL-Avtech-IP-Camera-Multiple-Command-Injection-Vulnerabilities Suspected Compromise
Fingerprint regexp changed
High Palo-Alto-Expedition-OS-Command-Injection-CVE-2024-9464 CVE-2024-9464 HTTP_CRL-Palo-Alto-Expedition-OS-Command-Injection-CVE-2024-9464 Suspected Compromise
Fingerprint regexp changed
High VHD-PTZ-Camera-Firmware-Command-Injection-CVE-2024-8957 CVE-2024-8957 HTTP_CRL-VHD-PTZ-Camera-Firmware-Command-Injection-CVE-2024-8957 Suspected Compromise
Fingerprint regexp changed
High Palo-Alto-SSLVPN-Command-Execution-CVE-2024-9474 CVE-2024-9474 HTTP_CRL-Palo-Alto-SSLVPN-Command-Execution-CVE-2024-9474 Suspected Compromise
Fingerprint regexp changed
High LibreNMS-Authenticated-Command-Injection-CVE-2024-51092 CVE-2024-51092 HTTP_CRL-LibreNMS-Authenticated-Command-Injection-CVE-2024-51092 Suspected Compromise
Fingerprint regexp changed
High Digiever-DS2105-Pro-Remote-Code-Execution No CVE/CAN HTTP_CRL-Digiever-DS2105-Pro-Remote-Code-Execution Suspected Compromise
Fingerprint regexp changed
High Teltonika-RUT9XX-Router-OS-Command-Injection-CVE-2018-17532 CVE-2018-17532 HTTP_CRL-Teltonika-RUT9XX-Router-OS-Command-Injection-CVE-2018-17532 Suspected Compromise
Fingerprint regexp changed
High Four-Faith-Routers-F3x24-F3x36-Remote-Command-Injection-CVE-2024-12856 CVE-2024-12856 HTTP_CRL-Four-Faith-Routers-F3x24-F3x36-Remote-Command-Injection-CVE-2024-12856 Suspected Compromise
Fingerprint regexp changed
High D-Link-TRENDnet-NCC-Service-Command-Injection CVE-2015-1187 HTTP_CRL-D-Link-TRENDnet-NCC-Service-Command-Injection Suspected Compromise
Fingerprint regexp changed
High Pfsense-Post-Auth-Group-Member-Command-Execution No CVE/CAN HTTP_CRL-Pfsense-Post-Auth-Group-Member-Command-Execution Suspected Compromise
Fingerprint regexp changed

LIST OF OTHER CHANGES:

New objects:

Type Name
Category Selenium Grid
Category OpenNMS Horizon
Situation Persistent_CRL_Cache-Event
Situation Persistent_CRL_Cache-Error
Element Ref Application dependency from Azure-Stack-HCI to Microsoft-Active-Protection-Service

Updated objects:

Type Name Changes
Situation URL_List-DNS-Over-HTTPS
Detection mechanism updated
IPList TOR exit nodes IP Address List
IPList Amazon AMAZON
IPList Amazon EC2
IPList TOR relay nodes IP Address List
IPList NordVPN Servers IP Address List
IPList Amazon AMAZON ap-southeast-2
IPList Forcepoint Drop IP Address List
IPList Amazon AMAZON us-west-2
IPList Amazon EC2 us-west-2
Situation HTTP_PSU-Shared-Variables
Fingerprint regexp changed
Application TOR
Application DNS-Over-HTTPS
Application NordVPN

DISCLAIMER AND COPYRIGHT

Copyright © 2025 Forcepoint
Forcepoint and the FORCEPOINT logo are trademarks of Forcepoint.

All other trademarks used in this document are the property of their respective owners.

Every effort has been made to ensure the accuracy of this document. However, Forcepoint makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Forcepoint shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice.