Release notes for update package 1260-5242

Important notice regarding low end appliances

The update package 1258 introduced changes to all DFA files. This change requires a heightened amount of memory during a policy install or policy refresh on the NGFW engine. On appliances with only 2 GB memory (N110, N115 and FW-315) this may lead to the memory running out during a policy install or policy refresh, resulting in a failed policy upload with errno 137. In rare circumstances, also appliances with 4 GB memory (e.g. N330, N325) may experience the same problem if they are operating near their performance limits concerning concurrent connections and / or have large VPN configuration.

If the previous active dynamic update package is below 1258, activating update package 1258 or any more recent update package may trigger the issue.

For more information and mitigation steps, see knowledge base article 18570.

This update package improves the detection capabilities of the Forcepoint NGFW system.

RELEASE DATE:	Monday July 06, 2020
MD5 CHECKSUM:	f417a4d243d0c647c7f4d4c771df7ef1
SHA1 CHECKSUM:	0773b03bc3c8583284acfadc51c928e4e7188550
SHA256 CHECKSUM:	7f6fd5703934ae919de1234828aefdd27306b9cd3478cba01ce303390965a6a2

UPDATE CRITICALITY: HIGH

MINIMUM SOFTWARE VERSIONS

- Forcepoint NGFW Security Management Center:	5.10.1.10027
- Forcepoint NGFW:	5.5.1.9848

List of detected attacks in this update package:

Risk level	Description	Reference	Vulnerability
High	An attempt to exploit a vulnerability in Microsoft Windows detected	CVE-2020-1206	Microsoft-Windows-SMBv3-Compression-Information-Disclosure
High	An attempt to exploit a vulnerability in Inductive Automation Ignition detected	CVE-2020-12000	Inductive-Automation-Ignition-Servermessageheader-Insecure-Deserialization
High	An attempt to exploit a vulnerability in Cisco Systems Data Center Network Manager detected	CVE-2019-15984	Cisco-Data-Center-Network-Manager-Getconfigtemplatefilename-SQL-Injection
High	An attempt to exploit a vulnerability in Microsoft SQL Server detected	CVE-2020-0618	Microsoft-SQL-Server-Reporting-Services-ViewState-RCE
High	An attempt to exploit a vulnerability in Oracle E-Business Suite detected	CVE-2020-2856	Oracle-E-Business-Suite-Advanced-Outbound-Telephony-CVE-2020-2856-XSS
High	An attempt to exploit a vulnerability in WordPress Project 10Web Photo Gallery detected	No CVE/CAN	Wordpress-10Web-Photo-Gallery-SQL-Injection
High	An attempt to exploit a vulnerability in rConfig Network Device Configuration Tool detected	CVE-2020-10546	rConfig-Compliancepolicies.PHP-SQL-Injection
High	An attempt to exploit a vulnerability in Cisco Systems Data Center Network Manager detected	CVE-2019-15981	Cisco-Data-Center-Network-Manager-Storefilecontentinfs-Directory-Traversal
High	An attempt to exploit a vulnerability in rConfig Network Device Configuration Tool detected	CVE-2020-10546	rConfig-Compliancepolicies_PHP-SQL-Injection
High	An attempt to exploit a vulnerability in Cisco Systems Data Center Network Manager detected	CVE-2019-15980	Cisco-Data-Center-Network-Manager-Savezoneinputfiletoserver-Directory-Traversal
High	An attempt to exploit a vulnerability in Oracle E-Business Suite detected	CVE-2020-2854	Oracle-E-Business-Suite-Advanced-Outbound-Telephony-CVE-2020-2854-XSS
High	An attempt to exploit a vulnerability in Cisco Systems Unified Contact Center Express (UCCX) detected	CVE-2020-3280	Cisco-Unified-Contact-Center-Express-Rmi-Insecure-Deserialization
High	An attempt to exploit a vulnerability in Nitro PDF Nitro Pro detected	CVE-2020-6074	Nitro-Pro-PDF-Nested-Pages-Use-After-Free
High	An attempt to exploit a vulnerability in Microsoft Windows detected	CVE-2020-1300	Microsoft-Windows-Cab-File-Parsing-Directory-Traversal
High	An attempt to exploit a vulnerability in Adobe Systems var6 Software Development Kit	CVE-2020-9590	Adobe-DNG-Software-Development-Kit-Readuncompressed-Heap-Buffer-Overflow

Jump to: Detected Attacks Other Changes

DETECTED ATTACKS

New detected attacks:

HTTP Client Stream

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Inductive-Automation-Ignition-Servermessageheader-Insecure-Deserialization	CVE-2020-12000	HTTP_CS-Inductive-Automation-Ignition-Servermessageheader-Insecure-Deserialization	Suspected Compromise
High	Cisco-Data-Center-Network-Manager-Getconfigtemplatefilename-SQL-Injection	CVE-2019-15984	HTTP_CS-Cisco-Data-Center-Network-Manager-Getconfigtemplatefilename-SQL-Injection	Suspected Compromise
High	Microsoft-SQL-Server-Reporting-Services-ViewState-RCE	CVE-2020-0618	HTTP_CS-Microsoft-SQL-Server-Reporting-Services-ViewState-RCE	Suspected Compromise

TCP SMB Client Stream

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Microsoft-Windows-SMBv3-Compression-Information-Disclosure	CVE-2020-1206	SMB-TCP_Microsoft-Windows-SMBv3-Compression-Information-Disclosure	Suspected Compromise

TCP Client Stream Unknown

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Cisco-Unified-Contact-Center-Express-Rmi-Insecure-Deserialization	CVE-2020-3280	Generic_CS-Cisco-Unified-Contact-Center-Express-Rmi-Insecure-Deserialization	Suspected Compromise

HTTP Request URI

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Oracle-E-Business-Suite-Advanced-Outbound-Telephony-CVE-2020-2856-XSS	CVE-2020-2856	HTTP_CSU-Oracle-E-Business-Suite-Advanced-Outbound-Telephony-CVE-2020-2856-Cross-Site-Scripting	Suspected Compromise
High	Wordpress-10Web-Photo-Gallery-SQL-Injection	No CVE/CAN	HTTP_CSU-Wordpress-10Web-Photo-Gallery-SQL-Injection	Suspected Compromise

HTTP Normalized Request-Line

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	rConfig-Compliancepolicies.PHP-SQL-Injection	CVE-2020-10546	HTTP_CRL-rConfig-Compliancepolicies-Snippets.PHP-SQL-Injection	Suspected Compromise
High	Cisco-Data-Center-Network-Manager-Storefilecontentinfs-Directory-Traversal	CVE-2019-15981	HTTP_CRL-Cisco-Data-Center-Network-Manager-Storefilecontentinfs-Directory-Traversal	Suspected Compromise
High	rConfig-Compliancepolicies_PHP-SQL-Injection	CVE-2020-10546	HTTP_CRL-rConfig-Compliancepolicies-PHP-SQL-Injection	Suspected Compromise
High	Cisco-Data-Center-Network-Manager-Savezoneinputfiletoserver-Directory-Traversal	CVE-2019-15980	HTTP_CRL-Cisco-Data-Center-Network-Manager-Savezoneinputfiletoserver-Directory-Traversal	Suspected Compromise
High	Oracle-E-Business-Suite-Advanced-Outbound-Telephony-CVE-2020-2854-XSS	CVE-2020-2854	HTTP_CRL-Oracle-E-Business-Suite-Advanced-Outbound-Telephony-CVE-2020-2854-XSS	Suspected Compromise

Other Binary File Stream

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Microsoft-Windows-Cab-File-Parsing-Directory-Traversal	CVE-2020-1300	File-Binary_Microsoft-Windows-Cab-File-Parsing-Directory-Traversal	Suspected Compromise
High	Adobe-DNG-Software-Development-Kit-Readuncompressed-Heap-Buffer-Overflow	CVE-2020-9590	File-Binary_Adobe-DNG-Software-Development-Kit-Readunvar10ed-Heap-Buffer-Overflow	Suspected Compromise

PDF File Stream

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Nitro-Pro-PDF-Nested-Pages-Use-After-Free	CVE-2020-6074	File-PDF_Nitro-Pro-PDF-Nested-Pages-Use-After-Free	Potential Compromise

Updated detected attacks:

HTTP Normalized Request-Line

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Apache-Kylin-Rest-API-Migratecube-Command-Injection

CVE-2020-1956

HTTP_CRL-Apache-Kylin-Rest-API-Migratecube-Command-Injection

Suspected Compromise

Fingerprint regexp changed

Text File Stream

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Apache-Kylin-Rest-API-Migratecube-Command-Injection

CVE-2020-1956

File-Text_Apache-Kylin-Rest-API-Migratecube-Command-Injection

Suspected Compromise

Fingerprint regexp changed

High

VBScript-Scripting-Detected

No CVE/CAN

File-Text_Obfuscated-VBScript-Detected

Potential Compromise

Fingerprint regexp changed

High

JavaScript-Obfuscation

No CVE/CAN

File-Text_JS-Obfuscator-Obfuscated-JavaScript-Detected

Suspected Attack Related Anomalies

Fingerprint regexp changed

High

JavaScript-Obfuscation

No CVE/CAN

File-Text_JavaScript-String-Value-Obfuscation

Suspected Attack Related Anomalies

Fingerprint regexp changed

High

JavaScript-Obfuscation

No CVE/CAN

File-Text_QZX-Obfuscated-JavaScript-Detected

Potential Compromise

Fingerprint regexp changed

High

JSFuck-JavaScript-Obfuscation

No CVE/CAN

File-Text_JSFuck-JavaScript-Obfuscation

Suspected Compromise

Fingerprint regexp changed

LIST OF OTHER CHANGES:

New objects:

Type	Name
Category	Nitro Pro PDF
Category	Inductive Automation Ignition
Category	Cisco Unified Contact Center Express (UCCX)
IPList	Amazon EC2_INSTANCE_CONNECT af-south-1
Web Authentication Page	DEP User Authentication Pages

Updated objects:

Type

Name

Changes

Network Element

TOR exit nodes

Situation

URL_List-Known-Hostile-URL

Detection mechanism updated

IPList

Åland

IPList

Bulgaria

IPList

Mauritius

IPList

Iceland

IPList

India

IPList

Cyprus

IPList

France

IPList

South Korea

IPList

Amazon AMAZON ap-south-1

IPList

Costa Rica

IPList

Belgium

IPList

Niue

IPList

Tanzania

IPList

Lebanon

IPList

Turkey

IPList

Liberia

IPList

Mongolia

IPList

Amazon AMAZON us-west-2

IPList

Amazon AMAZON us-west-1

IPList

Réunion

IPList

Slovakia

IPList

Ukraine

IPList

Kenya

IPList

Morocco

IPList

Guernsey

IPList

United States

IPList

Republic of Lithuania

IPList

Belize

IPList

Germany

IPList

Estonia

IPList

Microsoft Azure datacenter

IPList

Grenada

IPList

Canada

IPList

Rwanda

IPList

Eritrea

IPList

Netflix Servers

IPList

Equatorial Guinea

IPList

Nicaragua

IPList

Barbados

IPList

Madagascar

IPList

Bolivia

IPList

TOR relay nodes IP Address List

IPList

South Africa

IPList

U.S. Virgin Islands

IPList

Saint Martin

IPList

Sri Lanka

IPList

Cambodia

IPList

Argentina

IPList

Poland

IPList

Papua New Guinea

IPList

Japan

IPList

Mexico

IPList

Portugal

IPList

Sierra Leone

IPList

Uganda

IPList

Paraguay

IPList

Fiji

IPList

Mayotte

IPList

Amazon AMAZON cn-north-1

IPList

Peru

IPList

North Korea

IPList

Latvia

IPList

Nauru

IPList

Luxembourg

IPList

Venezuela

IPList

Akamai Servers

IPList

Honduras

IPList

Tokelau

IPList

Bhutan

IPList

Indonesia

IPList

United Arab Emirates

IPList

Spain

IPList

Puerto Rico

IPList

Guadeloupe

IPList

South Sudan

IPList

British Indian Ocean Territory

IPList

Nigeria

IPList

Thailand

IPList

Lesotho

IPList

Curaçao

IPList

Italy

IPList

North Macedonia

IPList

Ecuador

IPList

Guatemala

IPList

Maldives

IPList

Sudan

IPList

Brazil

IPList

Dominica

IPList

Albania

IPList

Trinidad and Tobago

IPList

Egypt

IPList

Panama

IPList

Israel

IPList

Somalia

IPList

Russia

IPList

Chile

IPList

Austria

IPList

Myanmar

IPList

Microsoft Azure datacenter USEAST

IPList

Anguilla

IPList

Hungary

IPList

Greece

IPList

Yemen

IPList

Serbia

IPList

Georgia

IPList

New Caledonia

IPList

Pakistan

IPList

Suriname

IPList

Amazon CLOUDFRONT

IPList

Finland

IPList

Dominican Republic

IPList

Congo Republic

IPList

Guyana

IPList

Saint Lucia

IPList

Iran

IPList

Cocos [Keeling] Islands

IPList

Bahamas

IPList

Azerbaijan

IPList

Switzerland

IPList

Bangladesh

IPList

Norfolk Island

IPList

Cabo Verde

IPList

Belarus

IPList

Oman

IPList

Ivory Coast

IPList

Slovenia

IPList

El Salvador

IPList

Kazakhstan

IPList

Martinique

IPList

Romania

IPList

Syria

IPList

Amazon EC2_INSTANCE_CONNECT

IPList

Jamaica

IPList

Webex Teams

IPList

TOR exit nodes IP Address List

IPList

Uzbekistan

IPList

Hong Kong

IPList

Croatia

IPList

Kosovo

IPList

DR Congo

IPList

Saint Vincent and the Grenadines

IPList

Amazon AMAZON eu-north-1

IPList

Sweden

IPList

French Guiana

IPList

United Kingdom

IPList

Malta

IPList

Singapore

IPList

Burundi

IPList

Ghana

IPList

Hashemite Kingdom of Jordan

IPList

Ireland

IPList

Nepal

IPList

Andorra

IPList

Macao

IPList

Vietnam

IPList

Jersey

IPList

China

IPList

Togo

IPList

Zimbabwe

IPList

Amazon AMAZON

IPList

Gibraltar

IPList

Netherlands

IPList

Bosnia and Herzegovina

IPList

Taiwan

IPList

Microsoft Azure datacenter USEAST2

IPList

Namibia

IPList

Facebook Servers

IPList

Australia

IPList

Zambia

IPList

Mauritania

IPList

Monaco

IPList

Comoros

IPList

British Virgin Islands

IPList

Saint Barthélemy

IPList

Armenia

IPList

Central African Republic

IPList

Montenegro

IPList

Qatar

IPList

Chad

IPList

Denmark

IPList

Colombia

IPList

Microsoft Azure datacenter USSOUTH

IPList

Antigua and Barbuda

IPList

Norway

IPList

Uruguay

IPList

Kiribati

IPList

Guam

IPList

New Zealand

IPList

Eswatini

IPList

Malaysia

IPList

Republic of Moldova

IPList

Amazon CLOUDFRONT us-east-1

IPList

Google Servers

IPList

Amazon AMAZON ca-central-1

IPList

Czechia

IPList

Samoa

IPList

Turks and Caicos Islands

IPList

Brunei

IPList

Djibouti

IPList

Bahrain

IPList

Afghanistan

IPList

Palestine

IPList

Philippines

IPList

San Marino

IPList

Laos

IPList

Senegal

IPList

Tonga

IPList

Microsoft Azure datacenter USWEST2

IPList

Seychelles

IPList

American Samoa

IPList

Saudi Arabia

IPList

Northern Mariana Islands

IPList

Liechtenstein

ACTIVATING THE UPDATE PACKAGE

Ensure that the SHA256 checksum of the update package are correct.
Open Admin Tools in the SMC GUI client.
Right-click on the Updates folder and select "Import Update Packages".
Right-click on the imported package and select Activate.
Reinstall the system policy to take the changes into use. Custom policies may require manual updating.

DISCLAIMER AND COPYRIGHT

The information in this document is provided only for educational purposes and for the convenience of Forcepoint customers. The information contained herein is subject to change without notice, and is provided "AS IS" without guarantee or warranty as to the accuracy or applicability of the information to any specific situation, circumstance, or system configuration - use at your own risk. Forcepoint does not warrant or endorse any third-party products described herein.

Forcepoint™ is a trademark of Forcepoint, LLC. SureView®, ThreatSeeker®, Triton®, Sidewinder®, and Stonesoft® are registered trademarks of Forcepoint, LLC. Raytheon® is a registered trademark of Raytheon Company. All other trademarks and registered trademarks are the property of their respective owners.

Copyright © 2000-2020 Forcepoint LLC. All rights reserved.