Release notes for update package 1428-5242

Rolling DFA upgrades

Starting from dynamic update 1393, the handling of situations appearing in multiple contexts is improved. To avoid the same traffic data to be matched against multiple DFA's, all DFA's are being modified. When large number of DFAs change at the same time, the temporary memory requirement during a policy installation or refresh increases. To avoid not enough available memory on low end NGFW appliances these changes on DFA's are implemented gradually over the course of 10 dynamic update packages. With low end NGFW appliances, especially N110 and N115, it is recommended to upgrade to NGFW version 6.8.2 or higher to better address new policy when there is not enough memory for both old and new policy. A large number of DFAs might change at the same time if there is a large gap between activating dynamic update packages and the subsequent policy refresh.

See knowledge base article 18570.

This update package improves the detection capabilities of the Forcepoint NGFW system.

RELEASE DATE:    Monday January 24, 2022
MD5 CHECKSUM:    155f3529e90422da77c35ea610421f16
SHA1 CHECKSUM:    4e0065766c7b334d527fadb96e8ef25e9584102e
SHA256 CHECKSUM:    1e649817406e8f32ae78082a39becee7bc6d881c75806211b6f78d92fb93237b

UPDATE CRITICALITY:    HIGH

MINIMUM SOFTWARE VERSIONS
- Forcepoint NGFW Security Management Center:    6.5.1.10631
- Forcepoint NGFW:    6.3.1.19034

List of detected attacks in this update package:

Risk levelDescriptionReferenceVulnerability
High     An attempt to exploit a vulnerability in Delta Industrial Automation DIAEnergie detected.     CVE-2021-44544     Delta-Industrial-Automation-Diaenergie-HandlerEnergyType-Stored-CSS
High     An attempt to exploit a vulnerability in Apache Software Foundation httpd detected     CVE-2021-44224     Apache-Httpd-Mod_Proxy-Ap_Proxy_Get_Worker_ex-Null-Pointer-Dereference
High     An attempt to exploit a vulnerability in Jetty Web Server detected.     CVE-2021-34429     Jetty-Web-INF-File-Disclosure
High     An attempt to exploit a vulnerability in Grafana Labs Grafana detected     CVE-2021-43813     Grafana-HS-Pluginmarkdown-Directory-Traversal
High     An attempt to exploit a vulnerability in Aviatrix Controller     CVE-2021-40870     Aviatrix-Controller-File-Upload-CVE-2021-40870
High     An attempt to exploit a vulnerability in Apache Airflow detected     CVE-2020-11978     Apache-Airflow-Remote-Code-Execution-CVE-2020-11978
High     An attempt to exploit a vulnerability in Oracle Business Intelligence Enterprise Edition detected     CVE-2020-14864     Oracle-Business-Intelligence-Enterprise-Edition-CVE-2020-14864
High     An attempt to exploit a vulnerability in Node.js systeminformation library detected     CVE-2021-21315     Node.js-Systeminformation-Library-Command-Injection-CVE-2021-21315

Jump to: Detected Attacks Other Changes

DETECTED ATTACKS

New detected attacks:

HTTP Request URI

RiskVulnerability/SituationReferencesRelated FingerprintSituation Type
High Delta-Industrial-Automation-Diaenergie-HandlerEnergyType-Stored-CSS CVE-2021-44544 HTTP_CSU-Delta-Industrial-Automation-Diaenergie-HandlerEnergyType-Stored-CSS Suspected Compromise
High Apache-Httpd-Mod_Proxy-Ap_Proxy_Get_Worker_ex-Null-Pointer-Dereference CVE-2021-44224 HTTP_CSU-Apache-Httpd-Mod_Proxy-Ap_Proxy_Get_Worker_ex-Null-Pointer-Dereference Suspected Compromise
High Jetty-Web-INF-File-Disclosure CVE-2021-34429 HTTP_CSU-etty-Web-INF-File-Disclosure Suspected Disclosure
High Grafana-HS-Pluginmarkdown-Directory-Traversal CVE-2021-43813 HTTP_CSU-Grafana-HS-Pluginmarkdown-Directory-Traversal Suspected Compromise

HTTP Normalized Request-Line

RiskVulnerability/SituationReferencesRelated FingerprintSituation Type
High Aviatrix-Controller-File-Upload-CVE-2021-40870 CVE-2021-40870 HTTP_CRL-Aviatrix-Controller-File-Upload-CVE-2021-40870 Suspected Compromise
High Apache-Airflow-Remote-Code-Execution-CVE-2020-11978 CVE-2020-11978 HTTP_CRL_Apache-Airflow-Remote-Code-Execution-CVE-2020-11978 Suspected Compromise
High Oracle-Business-Intelligence-Enterprise-Edition-CVE-2020-14864 CVE-2020-14864 HTTP_CRL_Oracle-Business-Intelligence-Enterprise-Edition-CVE-2020-14864 Suspected Compromise
High Node.js-Systeminformation-Library-Command-Injection-CVE-2021-21315 CVE-2021-21315 HTTP_CRL-Node.js-Systeminformation-Library-Command-Injection-CVE-2021-21315 Suspected Compromise

Updated detected attacks:

HTTP Request URI

RiskVulnerability/SituationReferencesRelated FingerprintSituation TypeChange Description
High Gozi-Malware-Infection-Traffic No CVE/CAN HTTP_CSU-Gozi-Malware-Infection-Traffic Suspected Botnet
Fingerprint regexp changed

HTTP Normalized Request-Line

RiskVulnerability/SituationReferencesRelated FingerprintSituation TypeChange Description
High Nagios-XI-Configwizards-Multiple-Command-Injections CVE-2021-25297 HTTP_CRL-Nagios-XI-Configwizards-Multiple-Command-Injections Suspected Compromise
Description has changed

LIST OF OTHER CHANGES:

New objects:

TypeName
CategoryAviatrix Controller
Web Authentication PageUser Authentication Pages with CSRF protection

Updated objects:

TypeNameChanges
IPListRwanda
IPListIraq
IPListSaudi Arabia
IPListIran
IPListCyprus
IPListDR Congo
IPListSeychelles
IPListJordan
IPListKuwait
IPListOman
IPListQatar
IPListBahrain
IPListUnited Arab Emirates
IPListIsrael
IPListTurkey
IPListEgypt
IPListGreece
IPListEstonia
IPListLatvia
IPListLithuania
IPListGeorgia
IPListMoldova
IPListBelarus
IPListFinland
IPListUkraine
IPListHungary
IPListBulgaria
IPListAlbania
IPListPoland
IPListRomania
IPListZimbabwe
IPListMauritius
IPListRéunion
IPListSouth Africa
IPListMayotte
IPListAfghanistan
IPListBangladesh
IPListTajikistan
IPListIndia
IPListNepal
IPListMyanmar
IPListUzbekistan
IPListKazakhstan
IPListKyrgyzstan
IPListVietnam
IPListThailand
IPListIndonesia
IPListTaiwan
IPListPhilippines
IPListMalaysia
IPListChina
IPListHong Kong
IPListMacao
IPListCambodia
IPListSouth Korea
IPListJapan
IPListSingapore
IPListTimor-Leste
IPListRussia
IPListMongolia
IPListAustralia
IPListNew Zealand
IPListPortugal
IPListNigeria
IPListGibraltar
IPListNiger
IPListTunisia
IPListSpain
IPListMorocco
IPListMalta
IPListAlgeria
IPListDenmark
IPListIceland
IPListUnited Kingdom
IPListSwitzerland
IPListSweden
IPListNetherlands
IPListAustria
IPListBelgium
IPListGermany
IPListLuxembourg
IPListIreland
IPListFrance
IPListAndorra
IPListLiechtenstein
IPListSlovakia
IPListCzechia
IPListNorway
IPListItaly
IPListSlovenia
IPListMontenegro
IPListCroatia
IPListBosnia and Herzegovina
IPListAngola
IPListBarbados
IPListGuyana
IPListFrench Guiana
IPListParaguay
IPListUruguay
IPListBrazil
IPListJamaica
IPListDominican Republic
IPListMartinique
IPListBahamas
IPListAnguilla
IPListSt Kitts and Nevis
IPListDominica
IPListAntigua and Barbuda
IPListSaint Lucia
IPListTurks and Caicos Islands
IPListBritish Virgin Islands
IPListMontserrat
IPListSaint Martin
IPListSaint Barthélemy
IPListGuadeloupe
IPListGrenada
IPListCayman Islands
IPListBelize
IPListGuatemala
IPListHonduras
IPListNicaragua
IPListCosta Rica
IPListVenezuela
IPListEcuador
IPListColombia
IPListPanama
IPListArgentina
IPListChile
IPListBolivia
IPListPeru
IPListMexico
IPListNorthern Mariana Islands
IPListGuam
IPListPuerto Rico
IPListU.S. Virgin Islands
IPListAmerican Samoa
IPListCanada
IPListUnited States
IPListPalestine
IPListSerbia
IPListSint Maarten
IPListTOR exit nodes IP Address List
IPListAmazon AMAZON
IPListGoogle Servers
IPListTOR relay nodes IP Address List
IPListAmazon GLOBALACCELERATOR
IPListBotnet IP Address List
IPListMalicious Site IP Address List
IPListAmazon AMAZON us-east-2
ApplicationCertificate-Revocation-List-Service
Category tag application_group Application Routing removed
Application detection context content changed

HOW TO IMPORT AND ACTIVATE THE DYNAMIC UPDATE PACKAGE

  1. Download the dynamic update package, then make sure that the checksums for the original files and the files that you have downloaded match.
  2. In the Management Client, select Menu > File > Import > Import Update Packages.
  3. Browse to the file, select it, then click Import.
  4. Select  Configuration, then browse to Administration > Other Elements > Updates.
  5. Right-click the imported dynamic update package, then select Activate.
  6. When the activation is finished, refresh the policy on all NGFW Engines. If your policy uses a custom template, you might need to edit the policy.

DISCLAIMER AND COPYRIGHT

Copyright © 2022 Forcepoint
Forcepoint and the FORCEPOINT logo are trademarks of Forcepoint.

All other trademarks used in this document are the property of their respective owners.

Every effort has been made to ensure the accuracy of this document. However, Forcepoint makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Forcepoint shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice.