Release notes for update package 1377-5242

This update package improves the detection capabilities of the Forcepoint NGFW system.

RELEASE DATE:    Thursday August 12, 2021
MD5 CHECKSUM:    830789f01d0489efe5deaec6f0b0beb7
SHA1 CHECKSUM:    679604b38961253d3f9ba32e3f86258628dbfe7f
SHA256 CHECKSUM:    7b53474947c38aef3437f730c680ff31b2bb77d78a12fc5843a19d5c288a2c17

UPDATE CRITICALITY:    HIGH

MINIMUM SOFTWARE VERSIONS
- Forcepoint NGFW Security Management Center:    6.5.1.10631
- Forcepoint NGFW:    6.3.1.19034

List of detected attacks in this update package:

Risk levelDescriptionReferenceVulnerability
High     An attempt to exploit a vulnerability in Dnsmasq detected.     CVE-2020-25687     Dnsmasq-Sort_rrset-CVE-2020-25687-Out-Of-Bounds-Write
High     An attempt to exploit a vulnerability in Dnsmasq detected.     CVE-2020-25682     Dnsmasq-extract_Name-Out-Of-Bounds-Write
High     An attempt to exploit a vulnerability in Apache Tomcat detected.     CVE-2020-13935     Apache-Tomcat-WebSocket-Infinite-Loop-DoS
High     An attempt to exploit a vulnerability in Code Remote - Containers detected.     CVE-2021-31213     Microsoft-Visual-Studio-Code-Remote-Containers-Extension-RCE
High     An attempt to exploit a vulnerability in Jenkins Selenium HTML Report Plugin detected.     CVE-2021-21672     Jenkins-Selenium-HTML-Report-Plugin-XML-External-Entity-Injection
High     An attempt to exploit a vulnerability in Automattic WooCommerce Blocks feature plugin detected     CVE-2021-32789     Automattic-Woocommerce-Blocks-Wordpress-Plugin-Store-API-SQL-Injection
High     Snake Keylogger infection traffic was detected     No CVE/CAN Snake-Keylogger-Infection-Traffic
High     Snake Keylogger infection traffic was detected     No CVE/CAN Snake-Keylogger-Infection-Traffic
High     Malicious redirection was detected     No CVE/CAN Malicious_Download_Redirect
High     An attempt to exploit a vulnerability in NetGear ProSAFE NMS300 detected     CVE-2021-27276     NetGear-ProSafe-NMS300-Mibcontroller-Realname-Directory-Traversal
High     An attempt to exploit a vulnerability in Nagios Enterprises Log Server detected     CVE-2021-35478     Nagios-Log-Server-Audit-Log-And-Alert-History-Reflected-Cross-Site-Scripting
High     An attempt to exploit a vulnerability in Atlassian JIRA and Service Management detected.     CVE-2020-36239     Atlassian-JIRA-And-Service-Management-Ehcache-Rmi-Insecure-Deserialization
High     Cobalt Strike C2 HTTP traffic was detected     No CVE/CAN Cobalt-Strike-C2-HTTP-Traffic

Jump to: Detected Attacks Other Changes

DETECTED ATTACKS

New detected attacks:

HTTP Client Stream

RiskVulnerability/SituationReferencesRelated FingerprintSituation Type
High Apache-Tomcat-WebSocket-Infinite-Loop-DoS CVE-2020-13935 HTTP_CS-Apache-Tomcat-WebSocket-Infinite-Loop-DoS Suspected Denial of Service
High Microsoft-Visual-Studio-Code-Remote-Containers-Extension-RCE CVE-2021-31213 HTTP_CS-Microsoft-Visual-Studio-Code-Remote-Containers-Extension-RCE Suspected Compromise
High Jenkins-Selenium-HTML-Report-Plugin-XML-External-Entity-Injection CVE-2021-21672 HTTP_CS-Jenkins-Selenium-HTML-Report-Plugin-XML-External-Entity-Injection Suspected Disclosure

FTP Client Stream

RiskVulnerability/SituationReferencesRelated FingerprintSituation Type
High Snake-Keylogger-Infection-Traffic No CVE/CAN FTP_CS-Snake-Keylogger-Infection-Traffic Suspected Botnet

SMTP Client Stream

RiskVulnerability/SituationReferencesRelated FingerprintSituation Type
High Snake-Keylogger-Infection-Traffic No CVE/CAN SMTP_CS-Snake-Keylogger-Infection-Traffic Suspected Botnet

DNS UDP Server Message

RiskVulnerability/SituationReferencesRelated FingerprintSituation Type
High Dnsmasq-Sort_rrset-CVE-2020-25687-Out-Of-Bounds-Write CVE-2020-25687 DNS-UDP_Dnsmasq-Sort_rrset-CVE-2020-25687-Out-Of-Bounds-Write Suspected Compromise
High Dnsmasq-extract_Name-Out-Of-Bounds-Write CVE-2020-25682 DNS-UDP_Dnsmasq-extract_Name-Out-Of-Bounds-Write Suspected Compromise

TCP Client Stream Unknown

RiskVulnerability/SituationReferencesRelated FingerprintSituation Type
High Atlassian-JIRA-And-Service-Management-Ehcache-Rmi-Insecure-Deserialization CVE-2020-36239 Generic_CS-Atlassian-JIRA-And-Service-Management-Ehcache-Rmi-Insecure-Deserialization Suspected Compromise

HTTP Request URI

RiskVulnerability/SituationReferencesRelated FingerprintSituation Type
High Automattic-Woocommerce-Blocks-Wordpress-Plugin-Store-API-SQL-Injection CVE-2021-32789 HTTP_CSU-Automattic-Woocommerce-Blocks-Wordpress-Plugin-Store-API-SQL-Injection Suspected Compromise

HTTP Request Header Line

RiskVulnerability/SituationReferencesRelated FingerprintSituation Type
High Cobalt-Strike-C2-HTTP-Traffic No CVE/CAN HTTP_CSH-Cobalt-Strike-C2-HTTP-Traffic Suspected Botnet

HTTP Normalized Request-Line

RiskVulnerability/SituationReferencesRelated FingerprintSituation Type
High NetGear-ProSafe-NMS300-Mibcontroller-Realname-Directory-Traversal CVE-2021-27276 HTTP_CRL-NetGear-ProSafe-NMS300-Mibcontroller-Realname-Directory-Traversal Suspected Compromise
High Nagios-Log-Server-Audit-Log-And-Alert-History-Reflected-Cross-Site-Scripting CVE-2021-35478 HTTP_CRL-Nagios-Log-Server-Audit-Log-And-Alert-History-Reflected-Cross-Site-Scripting Suspected Compromise

Text File Stream

RiskVulnerability/SituationReferencesRelated FingerprintSituation Type
High Malicious_Download_Redirect No CVE/CAN File-Text_Malicious_Download_Redirect Suspected Attack Related Anomalies

Updated detected attacks:

TCP Client Stream Unknown

RiskVulnerability/SituationReferencesRelated FingerprintSituation TypeChange Description
High PostgreSQL-Database-Datetime-Buffer-Overflow CVE-2014-0063 Generic_CS-PostgreSQL-Database-Datetime-Buffer-Overflow Suspected Compromise
Fingerprint regexp changed

LIST OF OTHER CHANGES:

New objects:

TypeName
CategoryJenkins Selenium HTML Report Plugin
CategoryAutomattic WooCommerce

Updated objects:

TypeNameChanges
IPListTOR exit nodes IP Address List
IPListAmazon AMAZON
IPListTOR relay nodes IP Address List
IPListBotnet IP Address List
IPListMalicious Site IP Address List
IPListAmazon AMAZON us-east-1
IPListAmazon AMAZON us-west-1
IPListCloudflare Servers
SituationHTTP_CSU-Shared-Variables

HOW TO IMPORT AND ACTIVATE THE DYNAMIC UPDATE PACKAGE

  1. Download the dynamic update package, then make sure that the checksums for the original files and the files that you have downloaded match.
  2. In the Management Client, select Menu > File > Import > Import Update Packages.
  3. Browse to the file, select it, then click Import.
  4. Select  Configuration, then browse to Administration > Other Elements > Updates.
  5. Right-click the imported dynamic update package, then select Activate.
  6. When the activation is finished, refresh the policy on all NGFW Engines. If your policy uses a custom template, you might need to edit the policy.

DISCLAIMER AND COPYRIGHT

Copyright © 2021 Forcepoint
Forcepoint and the FORCEPOINT logo are trademarks of Forcepoint.

All other trademarks used in this document are the property of their respective owners.

Every effort has been made to ensure the accuracy of this document. However, Forcepoint makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Forcepoint shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice.