Release notes for update package 1394-5242

Rolling DFA upgrades

Starting from dynamic update 1393, the handling of situations appearing in multiple contexts is improved. To avoid the same traffic data to be matched against multiple DFA's, all DFA's are being modified. When large number of DFAs change at the same time, the temporary memory requirement during a policy installation or refresh increases. To avoid not enough available memory on low end NGFW appliances these changes on DFA's are implemented gradually over the course of 10 dynamic update packages. With low end NGFW appliances, especially N110 and N115, it is recommended to upgrade to NGFW version 6.8.2 or higher to better address new policy when there is not enough memory for both old and new policy. A large number of DFAs might change at the same time if there is a large gap between activating dynamic update packages and the subsequent policy refresh.

See knowledge base article 18570.

This update package improves the detection capabilities of the Forcepoint NGFW system.

RELEASE DATE:	Monday October 11, 2021
MD5 CHECKSUM:	0a3ee204750bad9f83b05525828eed58
SHA1 CHECKSUM:	e6d0534489ada9d480649b0158dae7e47b80ddd7
SHA256 CHECKSUM:	cc7e75efc5819bd1229d355041bc5a36d8ff5a192348137f79493e85f6bff42d

UPDATE CRITICALITY: HIGH

MINIMUM SOFTWARE VERSIONS

- Forcepoint NGFW Security Management Center:	6.5.1.10631
- Forcepoint NGFW:	6.3.1.19034

List of detected attacks in this update package:

Risk level	Description	Reference	Vulnerability
High	Metasploit shellcode detection	No CVE/CAN	Shellcode-Encoder
High	Metasploit shellcode detection	No CVE/CAN	Shellcode-Encoder
High	Metasploit shellcode detection	No CVE/CAN	Shellcode-Encoder
High	Metasploit shellcode detection	No CVE/CAN	Shellcode-Encoder
High	Metasploit shellcode detection	No CVE/CAN	Shellcode-Encoder
High	Metasploit shellcode detection	No CVE/CAN	Shellcode-Encoder
High	Metasploit shellcode detection	No CVE/CAN	Shellcode-Encoder
High	Metasploit shellcode detection	No CVE/CAN	Shellcode-Encoder
High	Metasploit shellcode detection	No CVE/CAN	Shellcode-Encoder
High	Metasploit shellcode detection	No CVE/CAN	Shellcode-Encoder
High	Metasploit shellcode detection	No CVE/CAN	Shellcode-Encoder
High	Metasploit shellcode detection	No CVE/CAN	Shellcode-Encoder
High	Metasploit shellcode detection	No CVE/CAN	Shellcode-Encoder
High	Metasploit shellcode detection	No CVE/CAN	Shellcode-Encoder
High	Metasploit shellcode detection	No CVE/CAN	Shellcode-Encoder
High	Malicious KiXtart Script infection traffic detected	No CVE/CAN	Malicious-KiXtart-Script-Infection-Traffic
High	An attempt to exploit a vulnerability in Schneider Electric Struxureware Data Center Expert detected	CVE-2021-22795	Schneider-Electric-Struxureware-Data-Center-Expert-Command-Injection
High	An attempt to exploit a vulnerability in Zoho Corporation ManageEngine OpManager detected	CVE-2021-41288	Zoho-Manageengine-Opmanager-Getreportdata-SQL-Injection
High	An attempt to exploit a vulnerability in Delta Electronics DIAEnergie detected	CVE-2021-38390	Delta-Industrial-Automation-Diaenergie-Handlerenergytype.aspx-SQL-Injection

Jump to: Detected Attacks Other Changes

DETECTED ATTACKS

New detected attacks:

HTTP Request URI

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Malicious-KiXtart-Script-Infection-Traffic	No CVE/CAN	HTTP_CSU-Malicious-KiXtart-Script-Infection-Traffic	Suspected Botnet

ANY Common Stream

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Shellcode-Encoder	No CVE/CAN	Common_Metasploit-Payload-Windows-x64-Messagebox	Suspected Compromise
High	Shellcode-Encoder	No CVE/CAN	Common_Metasploit-Payload-Windows-X86-Format-All-Drives	Suspected Compromise
High	Shellcode-Encoder	No CVE/CAN	Common_Metasploit-Payload-Windows-X86-Messagebox	Suspected Compromise
High	Shellcode-Encoder	No CVE/CAN	Common_Metasploit-Payload-Windows-X86-Shell-Bind-TCP-Xpfw	Suspected Compromise
High	Shellcode-Encoder	No CVE/CAN	Common_Metasploit-Payload-Windows-X86-Speak-Pwned	Suspected Compromise
High	Shellcode-Encoder	No CVE/CAN	Common_Metasploit-Stager-Linux-Armle-Bind-TCP	Suspected Compromise
High	Shellcode-Encoder	No CVE/CAN	Common_Metasploit-Stager-Linux-Armle-Reverse-TCP	Suspected Compromise
High	Shellcode-Encoder	No CVE/CAN	Common_Metasploit-Stager-Linux-x64-Bind-TCP	Suspected Compromise
High	Shellcode-Encoder	No CVE/CAN	Common_Metasploit-Stager-Linux-x64-Reverse-TCP	Suspected Compromise
High	Shellcode-Encoder	No CVE/CAN	Common_Metasploit-Stager-Linux-X86-Bind-Nonx-TCP	Suspected Compromise
High	Shellcode-Encoder	No CVE/CAN	Common_Metasploit-Stager-Linux-X86-Bind-TCP	Suspected Compromise
High	Shellcode-Encoder	No CVE/CAN	Common_Metasploit-Stager-Linux-X86-Find-Tag	Suspected Compromise
High	Shellcode-Encoder	No CVE/CAN	Common_Metasploit-Stager-Linux-X86-Reverse-IPv6-TCP	Suspected Compromise
High	Shellcode-Encoder	No CVE/CAN	Common_Metasploit-Stager-Linux-X86-Reverse-Nonx-TCP	Suspected Compromise
High	Shellcode-Encoder	No CVE/CAN	Common_Metasploit-Stager-Linux-X86-Reverse-TCP	Suspected Compromise

HTTP Normalized Request-Line

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Schneider-Electric-Struxureware-Data-Center-Expert-Command-Injection	CVE-2021-22795	HTTP_CRL-Schneider-Electric-Struxureware-Data-Center-Expert-Command-Injection	Suspected Compromise
High	Zoho-Manageengine-Opmanager-Getreportdata-SQL-Injection	CVE-2021-41288	HTTP_CRL-Zoho-Manageengine-Opmanager-Getreportdata-SQL-Injection	Suspected Compromise
High	Delta-Industrial-Automation-Diaenergie-Handlerenergytype.aspx-SQL-Injection	CVE-2021-38390	HTTP_CRL-Delta-Industrial-Automation-Diaenergie-Handlerenergytype.aspx-SQL-Injection	Suspected Compromise

Updated detected attacks:

HTTP Client Stream

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

HP-Data-Protector-Multiple-Products-Finishedcopy-SQL-Injection

CVE-2011-3162

HTTP_CS-HP-Data-Protector-Multiple-Products-Finishedcopy-SQL-Injection

Suspected Compromise

Fingerprint regexp changed

High

HP-Data-Protector-Multiple-Products-Requestcopy-SQL-Injection

CVE-2011-3158

HTTP_CS-HP-Data-Protector-Multiple-Products-Requestcopy-SQL-Injection

Suspected Compromise

Fingerprint regexp changed

High

HP-Data-Protector-Multiple-Products-LogClientInstallation-SQL-Injection

CVE-2011-3156

HTTP_CS-HP-Data-Protector-Multiple-Products-LogClientInstallation-SQL-Injection

Suspected Compromise

Fingerprint regexp changed

High

SAP-Netweaver-Information-Disclosure

CVE-2013-3319

HTTP_CS-SAP-Netweaver-Information-Disclosure

Suspected Compromise

Fingerprint regexp changed

High

MirrorBlast-Malware-Infection-Traffic

No CVE/CAN

HTTP_CS-MirrorBlast-Malware-Infection-Traffic

Suspected Botnet

Fingerprint regexp changed

HTTP Request URI

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Apache-HTTP-Server-Path-Traversal-CVE-2021-41773

CVE-2021-41773

HTTP_CSU-Apache-HTTP-Server-Path-Traversal-CVE-2021-41773

Suspected Compromise

Description has changed

HTTP Normalized Request-Line

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

RevCode-RAT-C2-Traffic

No CVE/CAN

HTTP_CRL-RevCode-RAT-C2-Traffic

Suspected Botnet

Fingerprint regexp changed

Identified Text File Stream

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Microsoft-MSHTML-CVE-2021-40444-Remote-Code-Execution

CVE-2021-40444

File-TextId_Microsoft-MSHTML-CVE-2021-40444-Remote-Code-Execution

Suspected Compromise

Fingerprint regexp changed

LIST OF OTHER CHANGES:

New objects:

Type	Name
Category	Schneider Electric Struxureware Data Center Expert
IPList	Microsoft Azure service for PowerPlatformInfra

Updated objects:

Type

Name

Changes

Situation

URLList 2855526

Detection mechanism updated

Situation

URLList for LogicBox-CRM

Detection mechanism updated

Situation

URLList for RumbleTalk

Detection mechanism updated

Situation

URLList for Pastel-My-Business-Online

Detection mechanism updated

Situation

URLList for Intrix-Project

Detection mechanism updated

Situation

URLList for Connect2Field---Job-Management-Software

Detection mechanism updated

Situation

URLList for BillQuick

Detection mechanism updated

Situation

URLList for Gem-Accounts

Detection mechanism updated

Situation

URLList for Twinfield-Online-Accounting

Detection mechanism updated

Situation

URLList for Purchase-Control

Detection mechanism updated

IPList

Amazon AMAZON

IPList

Amazon S3

IPList

Amazon EC2

IPList

TOR relay nodes IP Address List

IPList

Microsoft Azure datacenter for centralus

IPList

Microsoft Azure datacenter for eastus2

IPList

Microsoft Azure datacenter for japaneast

IPList

Microsoft Azure datacenter for southcentralus

IPList

Microsoft Azure datacenter for southeastasia

IPList

Microsoft Azure datacenter for uksouth

IPList

Microsoft Azure datacenter for ukwest

IPList

Microsoft Azure datacenter for westus

IPList

Microsoft Azure datacenter

IPList

Zscaler IP Address List

IPList

Amazon AMAZON ap-south-2

IPList

Amazon EC2 ap-south-2

IPList

Amazon AMAZON ap-northeast-1

IPList

Amazon EC2 me-central-1

IPList

Amazon AMAZON me-central-1

IPList

Amazon S3 ap-northeast-1

IPList

Amazon AMAZON eu-central-2

IPList

Amazon EC2 eu-central-2

IPList

Botnet IP Address List

IPList

Malicious Site IP Address List

IPList

Amazon AMAZON ap-southeast-1

IPList

Amazon S3 ap-southeast-1

IPList

Amazon AMAZON eu-west-2

IPList

Amazon AMAZON us-east-1

IPList

Amazon EC2 us-east-1

IPList

Amazon AMAZON us-west-1

IPList

Amazon S3 us-west-1

IPList

Microsoft Azure datacenter for southafricanorth

IPList

Microsoft Azure service for AzureCloud

IPList

Microsoft Azure service for AzureMonitor

IPList

Microsoft Azure service for Sql

IPList

Microsoft Azure datacenter for westus3

IPList

Amazon EC2 ap-southeast-4

IPList

Amazon AMAZON ap-southeast-4

Situation

HTTP_CSU-Shared-Variables

Application

Yonyx-Interactive-Guides

Description has changed

Application

SwiftKanban

Description has changed

Application

PanTerra

Description has changed

Application

MSK-Digital-ID

Description has changed

Application

SupeRep

Description has changed

Application

xRP

Description has changed

Application

Appforma-Always-Marketing

Description has changed

Application

Accumulus-Subscription-and-Usage-Billing

Description has changed

Application

Comarch-Loyalty-Management

Description has changed

Application

CollabSpot

Description has changed

Application

EazeWork

Description has changed

Application

KumoTeam

Description has changed

Application

GroupDocs-Document-Manipulation-APIs

Description has changed

Application

VBVoice

Description has changed

Application

ETran

Description has changed

Application

WFMwizard

Description has changed

Application

LEADSExplorer

Description has changed

Application

Apptivo-Financials

Description has changed

Application

RSA-eBusiness

Description has changed

Application

Enterprise-Business-Software

Description has changed

HOW TO IMPORT AND ACTIVATE THE DYNAMIC UPDATE PACKAGE

Download the dynamic update package, then make sure that the checksums for the original files and the files that you have downloaded match.
In the Management Client, select Menu > File > Import > Import Update Packages.
Browse to the file, select it, then click Import.
Select Configuration, then browse to Administration > Other Elements > Updates.
Right-click the imported dynamic update package, then select Activate.
When the activation is finished, refresh the policy on all NGFW Engines. If your policy uses a custom template, you might need to edit the policy.

DISCLAIMER AND COPYRIGHT

Copyright © 2021 Forcepoint
Forcepoint and the FORCEPOINT logo are trademarks of Forcepoint.

All other trademarks used in this document are the property of their respective owners.

Every effort has been made to ensure the accuracy of this document. However, Forcepoint makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Forcepoint shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice.