Rolling DFA upgrades
Starting from dynamic update 1393, the handling of situations appearing in multiple contexts is improved.
To avoid the same traffic data to be matched against multiple DFA's, all DFA's are being modified.
When large number of DFAs change at the same time, the temporary memory requirement during a policy installation or refresh increases.
To avoid not enough available memory on low end NGFW appliances these changes on DFA's are implemented gradually over the course of 10 dynamic update packages.
With low end NGFW appliances, especially N110 and N115, it is recommended to upgrade to NGFW version 6.8.2 or higher to better address new policy when there is not enough memory for both old and new policy.
A large number of DFAs might change at the same time if there is a large gap between activating dynamic update packages and the subsequent policy refresh.
See knowledge base article 18570.
This update package improves the detection capabilities of the Forcepoint NGFW system.
| RELEASE DATE: | Thursday January 27, 2022 |
| MD5 CHECKSUM: | 360a1762b909755148167baf2a26242d |
| SHA1 CHECKSUM: | 133339a1242b0ae3484b79009afd2f97b821e3e3 |
| SHA256 CHECKSUM: | afdb52123bdf4c76d7c8f783a652c79383340e7e40cbd15fe1e2062a4eafea99 |
UPDATE CRITICALITY: HIGH
MINIMUM SOFTWARE VERSIONS
| - Forcepoint NGFW Security Management Center: | 6.5.1.10631 |
| - Forcepoint NGFW: | 6.3.1.19034 |
List of detected attacks in this update package:
| Risk level | Description | Reference | Vulnerability |
|---|---|---|---|
| High | An attempt to exploit a vulnerability in SonicWall detected | CVE-2021-20038 | SonicWall-Remote-Code-Execution-CVE-2021-20038 |
| High | An attempt to exploit a vulnerability in October CMS detected | CVE-2021-32648 | October-CMS-Unauthorized-Password-Change-CVE-2021-32648 |
| High | An attempt to exploit a vulnerability in Commvault CommCell detected | CVE-2021-34995 | Commvault-Commcell-Downloadcenteruploadhandler-Arbitrary-File-Upload |
| High | An attempt to exploit a vulnerability in H2 Database Project H2 Database detected | CVE-2021-42392 | H2-Database-Console-Jdbcutils-JNDI-Injection |
| High | An attempt to exploit a vulnerability in Ivanti Avalanche detected | CVE-2021-42132 | Ivanti-Avalanche-Printerdeviceserver-Service-Command-Injection |
| High | An attempt to exploit a vulnerability in Lighttpd Project Lighttpd detected | CVE-2022-22707 | Lighttpd-Mod_Extforward-Plugin-Mod_extforward_Forwarded-Denial-Of-Service |
| High | An attempt to exploit a vulnerability in Commvault CommCell detected | CVE-2021-34995 | Commvault-Commcell-Downloadcenteruploadhandler-Arbitrary-File-Upload |
| Low | Decimal encoded JavaScript detected | No CVE/CAN | JavaScript-Obfuscation |
Jump to: Detected Attacks Other Changes
DETECTED ATTACKS
New detected attacks:
TCP Client Stream Unknown
| Risk | Vulnerability/Situation | References | Related Fingerprint | Situation Type |
|---|---|---|---|---|
| High | Ivanti-Avalanche-Printerdeviceserver-Service-Command-Injection | CVE-2021-42132 | Generic_CS-Ivanti-Avalanche-Printerdeviceserver-Service-Command-Injection | Suspected Compromise |
HTTP Request URI
| Risk | Vulnerability/Situation | References | Related Fingerprint | Situation Type |
|---|---|---|---|---|
| High | SonicWall-Remote-Code-Execution-CVE-2021-20038 | CVE-2021-20038 | HTTP_CSU-SonicWall-Remote-Code-Execution-CVE-2021-20038 | Suspected Compromise |
HTTP Request Header Line
| Risk | Vulnerability/Situation | References | Related Fingerprint | Situation Type |
|---|---|---|---|---|
| High | Lighttpd-Mod_Extforward-Plugin-Mod_extforward_Forwarded-Denial-Of-Service | CVE-2022-22707 | HTTP_CSH-Lighttpd-Mod_Extforward-Plugin-Mod_extforward_Forwarded-Denial-Of-Service | Suspected Compromise |
HTTP Normalized Request-Line
| Risk | Vulnerability/Situation | References | Related Fingerprint | Situation Type |
|---|---|---|---|---|
| High | Commvault-Commcell-Downloadcenteruploadhandler-Arbitrary-File-Upload | CVE-2021-34995 | HTTP_CRL-Commvault-Commcell-Downloadcenteruploadhandler-Arbitrary-File-Upload | Suspected Compromise |
| High | H2-Database-Console-Jdbcutils-JNDI-Injection | CVE-2021-42392 | HTTP_CRL-H2-Database-Console-Jdbcutils-JNDI-Injection | Suspected Compromise |
Text File Stream
| Risk | Vulnerability/Situation | References | Related Fingerprint | Situation Type |
|---|---|---|---|---|
| Low | JavaScript-Obfuscation | No CVE/CAN | File-Text_Decimal-Encoded-JavaScript-2 | Possibly Unwanted Content |
| High | October-CMS-Unauthorized-Password-Change-CVE-2021-32648 | CVE-2021-32648 | File-Text_October-CMS-Unauthorized-Password-Change-CVE-2021-32648 | Suspected Compromise |
Identified Text File Stream
| Risk | Vulnerability/Situation | References | Related Fingerprint | Situation Type |
|---|---|---|---|---|
| High | Commvault-Commcell-Downloadcenteruploadhandler-Arbitrary-File-Upload | CVE-2021-34995 | File-TextId_Commvault-Commcell-Downloadcenteruploadhandler-Arbitrary-File-Upload | Suspected Compromise |
Updated detected attacks:
HTTP Client Stream
| Risk | Vulnerability/Situation | References | Related Fingerprint | Situation Type | Change Description | |
|---|---|---|---|---|---|---|
| Critical | Log4j-Remote-Code-Execution | CVE-2021-44228 | HTTP_CS_Log4j-Remote-Code-Execution-Evasion | Suspected Compromise |
|
HTTP Request URI
| Risk | Vulnerability/Situation | References | Related Fingerprint | Situation Type | Change Description | |
|---|---|---|---|---|---|---|
| High | Grafana-HS-Pluginmarkdown-Directory-Traversal | CVE-2021-43813 | HTTP_CSU-Grafana-HS-Pluginmarkdown-Directory-Traversal | Suspected Compromise |
|
HTTP Request Header Line
| Risk | Vulnerability/Situation | References | Related Fingerprint | Situation Type | Change Description | |||
|---|---|---|---|---|---|---|---|---|
| High | HTTP_Protocol_Stack_Remote_Code_Execution_Vulnerability_CVE-2022-21907 | CVE-2022-21907 | HTTP_CRH-HTTP_Protocol_Stack_Remote_Code_Execution_Vulnerability_CVE-2021-31166 | Suspected Compromise |
|
|||
| High | HTTP_Protocol_Stack_Remote_Code_Execution_Vulnerability_CVE-2022-21907 | CVE-2022-21907 | HTTP_CRH-Microsoft-IIS-HTTP-Protocol-Stack-Remote-Code-Execution | Suspected Compromise |
|
IP Option Detection
| Risk | Vulnerability/Situation | References | Related Fingerprint | Situation Type | Change Description | |
|---|---|---|---|---|---|---|
| Low | VxWorks-Stack-Overflow-Vulnerability-CVE-2019-12256 | CVE-2019-12256 | IP Option Loose Source Route | Malicious Routing |
|
|
| Low | VxWorks-Stack-Overflow-Vulnerability-CVE-2019-12256 | CVE-2019-12256 | IP Option Strict Source Route | Malicious Routing |
|
UDP without parameters
| Risk | Vulnerability/Situation | References | Related Fingerprint | Situation Type | Change Description | |
|---|---|---|---|---|---|---|
| Low | Samba-Nmbd-Sys_recvfrom-Infinite-Loop-Denial-Of-Service | CVE-2014-0244 | UDP_Checksum-Mismatch | Invalid Packet |
|
TCP without parameters
| Risk | Vulnerability/Situation | References | Related Fingerprint | Situation Type | Change Description | |
|---|---|---|---|---|---|---|
| Low | TCP_Linux-Kernel-Firewall-Logging-Denial-Of-Service | CVE-2004-0816 | TCP_Header-Length-Error | Invalid Packet |
|
|
| Low | FreeBSD-TCP-Reassembly-Denial-Of-Service | CVE-2014-3000 | TCP_Segment-Invalid | Probe |
|
IP without parameters
| Risk | Vulnerability/Situation | References | Related Fingerprint | Situation Type | Change Description | |
|---|---|---|---|---|---|---|
| Moderate | ICMP-Microsoft-Windows-Kernel-ICMP-Fragmented-Packet-DOS | CVE-2007-0066 | IP_Fragment-Invalid-Size | Invalid Packet |
|
|
| Moderate | Microsoft-Windows-IP-Validation-Vulnerability | CVE-2005-0048 | IP_Option-Too-Long | Compromise |
|
|
| Low | Red-Hat-Netkvm-Virtio-Win-GetXxpHeaderAndPayloadLen-Integer-Underflow | CVE-2015-3215 | IP_Length-Total-Error | Invalid Packet |
|
|
| Low | Microsoft-Windows-IPv6-Router-Advertisement-Stack-Buffer-Overflow | CVE-2010-0239 | IP_Length-Inconsistency | Protocol Violations |
|
|
| Moderate | Linux-Kernel-IPv6-Netfilter-Nf_CT_frag6_reasm-Null-Pointer-Dereference-DoS | CVE-2012-2744 | IP_Fragment-Size-Zero | Invalid Packet |
|
|
| Low | Microsoft-TCP-IP-Remote-Code-Execution-CVE-2021-24074 | CVE-2021-24074 | IP_Options-Malformed | Invalid Packet |
|
HTTP Normalized Request-Line
| Risk | Vulnerability/Situation | References | Related Fingerprint | Situation Type | Change Description | |
|---|---|---|---|---|---|---|
| Critical | Log4j-Remote-Code-Execution | CVE-2021-44228 | HTTP_CRL-Log4j-Remote-Code-Execution | Suspected Compromise |
|
Non-ratebased DoS attacks
| Risk | Vulnerability/Situation | References | Related Fingerprint | Situation Type | Change Description | |
|---|---|---|---|---|---|---|
| Moderate | ICMP-DoS-Jolt-Vulnerability | CVE-1999-0345 | DOS_JOLT | Invalid Packet DoS |
|
|
| Moderate | Windows_Xp_2003_Land_Attack_DoS | CVE-2005-0688 | DOS_LAND | Invalid Packet DoS |
|
|
| Moderate | IP-Nestea-IP-Fragmentation-Denial-Of-Service | CVE-1999-0257 | DOS_NESTEA | Invalid Packet DoS |
|
|
| Moderate | IP-Newtear-IP-Fragmentation-Denial-Of-Service | No CVE/CAN | DOS_NEWTEAR | Invalid Packet DoS |
|
|
| Moderate | IP-Teardrop-DoS | CVE-1999-0015 | DOS_TEARDROP | Invalid Packet DoS |
|
|
| Moderate | WinNuke-DoS | CVE-1999-0153 | DOS_WINNUKE | Inspection |
|
|
| Moderate | IP-UDP-Saihyousen-Denial-Of-Service | No CVE/CAN | DOS_SAIHYOUSEN | Invalid Packet DoS |
|
|
| Moderate | IP-Oshare-Bogus-IP-Fragmentation-DoS | CVE-1999-0357 | DOS_OSHARE | Invalid Packet DoS |
|
|
| Moderate | IP-Bonk-IP-Fragmentation-Denial-Of-Service | CVE-1999-0258 | DOS_BONK | Invalid Packet DoS |
|
|
| Moderate | IP-ICMP-1234.c-DoS | No CVE/CAN | DOS_1234 | Invalid Packet DoS |
|
IPv6 without parameters
| Risk | Vulnerability/Situation | References | Related Fingerprint | Situation Type | Change Description | |
|---|---|---|---|---|---|---|
| Low | Microsoft-TCP-IP-Denial-Of-Service-CVE-2021-24086 | CVE-2021-24086 | IPv6_Routing-header-type-unknown | Invalid Packet |
|
|
| Low | Red-Hat-Netkvm-Virtio-Win-GetXxpHeaderAndPayloadLen-Integer-Underflow | CVE-2015-3215 | IPv6_Extension-headers-incomplete | Invalid Packet |
|
|
| Moderate | Microsoft-TCP-IP-Denial-Of-Service-CVE-2021-24086 | CVE-2021-24086 | IPv6_Option-misaligned | Invalid Packet |
|
|
| Low | Microsoft-TCP-IP-Remote-Code-Execution-CVE-2021-24094 | CVE-2021-24094 | IPv6_Atomic-Fragment | Invalid Packet |
|
|
| Low | Microsoft-TCP-IP-Denial-Of-Service-CVE-2021-24086 | CVE-2021-24086 | IPv6_Invalid-Type0-Routing-Header | Invalid Packet |
|
Text File Stream
LIST OF OTHER CHANGES:
New objects:
| Type | Name |
|---|---|
| Category | H2 Database |
| Category | MS2022 |
| Category | MS2022-01 |
| Category | CVE2022 |
| Network Element | DNS Google |
| Network Element | DNS Cloudflare |
| Network Element | DNS Quad9 |
Updated objects:
| Type | Name | Changes | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| IPList | TOR exit nodes IP Address List | ||||||||||||
| IPList | Amazon AMAZON | ||||||||||||
| IPList | Amazon S3 | ||||||||||||
| IPList | Amazon EC2 | ||||||||||||
| IPList | Google Servers | ||||||||||||
| IPList | Amazon CLOUDFRONT | ||||||||||||
| IPList | Akamai Servers | ||||||||||||
| IPList | Microsoft Azure datacenter for canadacentral | ||||||||||||
| IPList | TOR relay nodes IP Address List | ||||||||||||
| IPList | Microsoft Azure datacenter for centralindia | ||||||||||||
| IPList | Microsoft Azure datacenter for eastus2 | ||||||||||||
| IPList | Microsoft Azure datacenter for centralfrance | ||||||||||||
| IPList | Microsoft Azure datacenter for northeurope | ||||||||||||
| IPList | Microsoft Azure datacenter for southcentralus | ||||||||||||
| IPList | Microsoft Azure datacenter for southindia | ||||||||||||
| IPList | Microsoft Azure datacenter for westus | ||||||||||||
| IPList | Microsoft Azure datacenter | ||||||||||||
| IPList | Amazon AMAZON ap-south-2 | ||||||||||||
| IPList | Botnet IP Address List | ||||||||||||
| IPList | Malicious Site IP Address List | ||||||||||||
| IPList | Amazon AMAZON ap-south-1 | ||||||||||||
| IPList | Amazon EC2 ap-south-1 | ||||||||||||
| IPList | Amazon AMAZON ap-southeast-2 | ||||||||||||
| IPList | Amazon S3 eu-north-1 | ||||||||||||
| IPList | Amazon AMAZON eu-west-1 | ||||||||||||
| IPList | Amazon AMAZON eu-west-3 | ||||||||||||
| IPList | Amazon AMAZON us-east-1 | ||||||||||||
| IPList | Amazon S3 us-east-1 | ||||||||||||
| IPList | Amazon AMAZON us-east-2 | ||||||||||||
| IPList | Amazon AMAZON us-west-2 | ||||||||||||
| IPList | Amazon EC2 us-west-2 | ||||||||||||
| IPList | Microsoft Azure service for AppConfiguration | ||||||||||||
| IPList | Microsoft Azure service for AppServiceManagement | ||||||||||||
| IPList | Microsoft Azure service for AzureAdvancedThreatProtection | ||||||||||||
| IPList | Microsoft Azure service for AzureBackup | ||||||||||||
| IPList | Microsoft Azure service for AzureCloud | ||||||||||||
| IPList | Microsoft Azure service for AzureContainerRegistry | ||||||||||||
| IPList | Microsoft Azure service for AzureCosmosDB | ||||||||||||
| IPList | Microsoft Azure service for AzureDataExplorerManagement | ||||||||||||
| IPList | Microsoft Azure service for AzureFrontDoor_FirstParty | ||||||||||||
| IPList | Microsoft Azure service for AzureIoTHub | ||||||||||||
| IPList | Microsoft Azure service for AzureKeyVault | ||||||||||||
| IPList | Microsoft Azure service for AzureMachineLearning | ||||||||||||
| IPList | Microsoft Azure service for AzureMonitor | ||||||||||||
| IPList | Microsoft Azure service for AzureMonitor_Core | ||||||||||||
| IPList | Microsoft Azure service for AzureSiteRecovery | ||||||||||||
| IPList | Microsoft Azure service for CognitiveServicesManagement | ||||||||||||
| IPList | Microsoft Azure service for DataFactory | ||||||||||||
| IPList | Microsoft Azure service for DataFactoryManagement | ||||||||||||
| IPList | Microsoft Azure service for EventHub | ||||||||||||
| IPList | Microsoft Azure service for GuestAndHybridManagement | ||||||||||||
| IPList | Microsoft Azure service for LogicApps | ||||||||||||
| IPList | Microsoft Azure service for MicrosoftContainerRegistry | ||||||||||||
| IPList | Microsoft Azure service for ServiceBus | ||||||||||||
| IPList | Microsoft Azure service for ServiceFabric | ||||||||||||
| IPList | Microsoft Azure service for Sql | ||||||||||||
| IPList | Microsoft Azure service for SqlManagement | ||||||||||||
| IPList | Microsoft Azure service for EOPExternalPublishedIPs | ||||||||||||
| IPList | Microsoft Azure datacenter for isrealcentral | ||||||||||||
| IPList | Microsoft Azure datacenter for polandcentral | ||||||||||||
| Report | Inspected Connection Trends by Action (Counters) | ||||||||||||
| Report | Log Trends by Data Type (Counters) | ||||||||||||
| Report | Allowed Traffic Trends by Sender (Counters) | ||||||||||||
| Report | VPN Traffic Trends (Counters) | ||||||||||||
| Report | Packet Drop Trends by Sender (Counters) | ||||||||||||
| Situation | IPv4_Version-Not-4 |
|
|||||||||||
| Situation | UDP_Packet-Too-Short |
|
|||||||||||
| Situation | UDP_Packet-Too-Long |
|
|||||||||||
| Situation | UDP_Packet-Length-Inconsistency |
|
|||||||||||
| Situation | IP_Checksum-Mismatch |
|
|||||||||||
| Situation | IP_Datagram-Fragments-Flags-Conflict |
|
|||||||||||
| Situation | IP_Fragments-Size-Conflict |
|
|||||||||||
| Situation | IP_Fragment-Offset-Overflow |
|
|||||||||||
| Situation | IP_Header-Length-Error |
|
|||||||||||
| Situation | IP_Options-Unused |
|
|||||||||||
| Situation | IP_Option-Too-Short |
|
|||||||||||
| Situation | IP_Addresses-Same |
|
|||||||||||
| Situation | IP_Time-To-Live-Zero |
|
|||||||||||
| Situation | ICMP_Checksum-Mismatch |
|
|||||||||||
| Situation | ICMP_Message-Empty |
|
|||||||||||
| Situation | ICMP_Message-Too-Short |
|
|||||||||||
| Situation | TCP_Checksum-Mismatch |
|
|||||||||||
| Situation | TCP_Option-Invalid |
|
|||||||||||
| Situation | TCP_Option-Unknown |
|
|||||||||||
| Situation | TCP_Option-Unsupported |
|
|||||||||||
| Situation | IP Option Record Route |
|
|||||||||||
| Situation | DOS_SYNDROP |
|
|||||||||||
| Situation | DOS_LINUX_ICMP |
|
|||||||||||
| Situation | GRE_Header-Short |
|
|||||||||||
| Situation | GRE-unknown-version |
|
|||||||||||
| Situation | GRE_Checksum-Mismatch |
|
|||||||||||
| Situation | GRE_Tunnel-Other-Protocol |
|
|||||||||||
| Situation | GRE_Keepalive |
|
|||||||||||
| Situation | IP-Multicast-Source |
|
|||||||||||
| Situation | Tunneling Level Limit Exceeded |
|
|||||||||||
| Situation | IPv6_Hop-Limit-Zero |
|
|||||||||||
| Situation | IPv6_Version-Not-6 |
|
|||||||||||
| Situation | ICMP_IP_ver-not-4 |
|
|||||||||||
| Situation | IPv6_Extension-header-recommended-order-inconsistency |
|
|||||||||||
| Situation | IPv6_Routing-header-type-0 |
|
|||||||||||
| Situation | IPv6_Extension-header-length-inconsistency |
|
|||||||||||
| Situation | IPv6_Routing-segments-left-inconsistency |
|
|||||||||||
| Situation | IPv6_Option-data-length-incorrect |
|
|||||||||||
| Situation | IPv6_Option-not-allowed-in-hop-by-hop-options |
|
|||||||||||
| Situation | IPv6_Option-not-allowed-in-destination-options |
|
|||||||||||
| Situation | IPv6_Authentication-header-length-incorrect |
|
|||||||||||
| Situation | IPv6_Recursive-Fragmentation |
|
|||||||||||
| Situation | IPv6_Invalid-Hop-by-Hop-Header-Position |
|
|||||||||||
| Situation | IPv6_Reassembled-Payload-Too-Large |
|
|||||||||||
| Situation | IPv6_Invalid-Home-Address-Option |
|
|||||||||||
| Situation | IPv6_Fragment-Size-Zero |
|
|||||||||||
| Situation | IPv6_Invalid-Quick-Start-Option |
|
|||||||||||
| Situation | IPv6_Invalid-Mobility-Header |
|
|||||||||||
| Situation | IPv6_Mobility-Header-Invalid-Nexthdr |
|
|||||||||||
| Situation | IPv6_Mobility-Header-Unknown-Type |
|
|||||||||||
| Situation | IPv6_Invalid-Jumbo-Payload-Option |
|
|||||||||||
| Situation | IPv6_Invalid-Type2-Routing-Header |
|
|||||||||||
| Situation | IPv6_Fragment-Invalid-Size |
|
|||||||||||
| Situation | TCP_Segment-SYN-No-Options |
|
|||||||||||
| Situation | IP_Fragment-Time-To-Live-Varies |
|
|||||||||||
| Situation | IPv6_Loopback-Address |
|
|||||||||||
| Situation | IPIP_Header-Short |
|
|||||||||||
| Situation | IPIPv6_Header-Short |
|
|||||||||||
| Situation | GRE_PPTP-Version |
|
|||||||||||
| Situation | ICMPv6_IP_ver-not-6 |
|
|||||||||||
| Situation | HTTP_CSU-Shared-Variables | ||||||||||||
| Situation | HTTP_SHS-Acceptable-Long-Headers |
|
|||||||||||
| Situation | HTTP_CRL-Openemr-Download_Template-Directory-Traversal |
|
|||||||||||
| Situation | HTTP_CRL-rConfig-Compliancepolicies-PHP-SQL-Injection |
|
HOW TO IMPORT AND ACTIVATE THE DYNAMIC UPDATE PACKAGE
- Download the dynamic update package, then make sure that the checksums for the original files and the files that you have downloaded match.
- In the Management Client, select Menu > File > Import > Import Update Packages.
- Browse to the file, select it, then click Import.
- Select Configuration, then browse to Administration > Other Elements > Updates.
- Right-click the imported dynamic update package, then select Activate.
- When the activation is finished, refresh the policy on all NGFW Engines. If your policy uses a custom template, you might need to edit the policy.
DISCLAIMER AND COPYRIGHT
Copyright © 2022 Forcepoint
Forcepoint and the FORCEPOINT logo are trademarks of Forcepoint.
All other trademarks used in this document are the property of their respective owners.
Every effort has been made to ensure the accuracy of this document. However, Forcepoint makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Forcepoint shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice.
Forcepoint and the FORCEPOINT logo are trademarks of Forcepoint.
All other trademarks used in this document are the property of their respective owners.
Every effort has been made to ensure the accuracy of this document. However, Forcepoint makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Forcepoint shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice.