Release notes for update package 1435-5242

This update package improves the detection capabilities of the Forcepoint NGFW system.

RELEASE DATE:    Tuesday February 15, 2022
MD5 CHECKSUM:    dbf93ed0e990d03da1af5588e41e72e0
SHA1 CHECKSUM:    f9395264979ae0135eb576973b342cc750ea40a8
SHA256 CHECKSUM:    3b00f925fb77adf170b98b73a30e432f24d289a18854fa3fa34b0fc4727430a4

UPDATE CRITICALITY:    HIGH

MINIMUM SOFTWARE VERSIONS
- Forcepoint NGFW Security Management Center:    6.5.1.10631
- Forcepoint NGFW:    6.3.1.19034

List of detected attacks in this update package:

Risk levelDescriptionReferenceVulnerability
High     An attempt to exploit a vulnerability in CodeIgniter PHP framework detected.     CVE-2022-21647     CodeIgniter-Common.php-Insecure-Deserialization
High     An attempt to exploit a vulnerability in the Wordpress Catch Themes Demo Plugin detected.     CVE-2021-39352     Wordpress-Plugin-Catch-Themes-Demo-Import-RCE
High     An attempt to exploit a vulnerability in Grandstream GXV3175 IP multimedia phones detected.     CVE-2019-10655     Grandstream-GXV3175-Settimezone-Unauthenticated-Command-Execution
High     An attempt to exploit a vulnerability in Grandstream UCM62xx IP PBX devices detected.     CVE-2020-5722     Grandstream-UCM62xx-IP-PBX-SendPasswordEmail-RCE
High     An attempt to exploit a vulnerability in Ivanti Avalanche detected     CVE-2021-42127     Ivanti-Avalanche-Statserver-Service-Insecure-Deserialization
High     An attempt to exploit a vulnerability in Oracle WebLogic detected     CVE-2021-2394     Oracle-WebLogic-Insecure-Deserialization-CVE-2021-2394
High     An attempt to exploit a vulnerability in ImageMagick detected.     CVE-2021-3781     Imagemagick-PDF-And-PostScript-Image-Ghostscript-Command-Injection

Jump to: Detected Attacks Other Changes

DETECTED ATTACKS

New detected attacks:

HTTP Client Stream

RiskVulnerability/SituationReferencesRelated FingerprintSituation Type
High CodeIgniter-Common.php-Insecure-Deserialization CVE-2022-21647 HTTP_CS-CodeIgniter-Common.php-Insecure-Deserialization Suspected Compromise
High Wordpress-Plugin-Catch-Themes-Demo-Import-RCE CVE-2021-39352 HTTP_CS-Wordpress-Plugin-Catch-Themes-Demo-Import-RCE Suspected Compromise
High Grandstream-GXV3175-Settimezone-Unauthenticated-Command-Execution CVE-2019-10655 HTTP_CS-Grandstream-GXV3175-Settimezone-Unauthenticated-Command-Execution Suspected Compromise
High Grandstream-UCM62xx-IP-PBX-SendPasswordEmail-RCE CVE-2020-5722 HTTP_CS-Grandstream-UCM62xx-IP-PBX-SendPasswordEmail-RCE Suspected Compromise

TCP Client Stream Unknown

RiskVulnerability/SituationReferencesRelated FingerprintSituation Type
High Ivanti-Avalanche-Statserver-Service-Insecure-Deserialization CVE-2021-42127 Generic_CS-Ivanti-Avalanche-Statserver-Service-Insecure-Deserialization Suspected Compromise
High Oracle-WebLogic-Insecure-Deserialization-CVE-2021-2394 CVE-2021-2394 Generic_CS-Oracle-WebLogic-Insecure-Deserialization-CVE-2021-2394 Suspected Compromise

Identified Text File Stream

RiskVulnerability/SituationReferencesRelated FingerprintSituation Type
High Imagemagick-PDF-And-PostScript-Image-Ghostscript-Command-Injection CVE-2021-3781 File-TextId_Imagemagick-PDF-And-PostScript-Image-Ghostscript-Command-Injection Suspected Compromise

Updated detected attacks:

HTTP Normalized Request-Line

RiskVulnerability/SituationReferencesRelated FingerprintSituation TypeChange Description
High Pandora-FMS-Events-RCE CVE-2020-13851 HTTP_CRL-Pandora-FMS-Events-RCE Suspected Compromise
Fingerprint regexp changed

SMB Client Header Stream

RiskVulnerability/SituationReferencesRelated FingerprintSituation TypeChange Description
High Samba-Vfs_Fruit-Module-Adeid_Finderi-Handling-Out-Of-Bounds-Read-And-Write CVE-2021-44142 SMB-TCP_CHS-Samba-Vfs_Fruit-Module-Adeid_Finderi-Handling-Out-Of-Bounds-Read-And-Write Suspected Compromise
Detection mechanism updated

Text File Stream

RiskVulnerability/SituationReferencesRelated FingerprintSituation TypeChange Description
High Mozilla-Firefox-document.write-And-DOM-Insertions-Memory-Corruption CVE-2010-3765 File-Text_Mozilla-Firefox-document.write-And-DOM-Insertions-Memory-Corruption-2 Suspected Compromise
Detection mechanism updated
High Microsoft-Internet-Explorer-CVE-2015-0100-Use-After-Free CVE-2015-0100 File-Text_Microsoft-Internet-Explorer-CVE-2015-0100-Use-After-Free Suspected Compromise
Detection mechanism updated
High Microsoft-Internet-Explorer-Cgeneratedcontent-Unwrapcontent-Memory-Corruption CVE-2015-1622 File-Text_Microsoft-Internet-Explorer-Cgeneratedcontent-Unwrapcontent-Memory-Corruption Suspected Compromise
Detection mechanism updated

LIST OF OTHER CHANGES:

New objects:

TypeName
CategoryCodeIgniter
CategoryWordpress Catch Themes Demo Import Plugin
IPListAmazon S3 il-central-1
IPListAmazon EC2 il-central-1

Updated objects:

TypeNameChanges
IPListTOR exit nodes IP Address List
IPListAmazon AMAZON
IPListAmazon EC2
IPListAkamai Servers
IPListTOR relay nodes IP Address List
IPListAmazon AMAZON il-central-1
IPListBotnet IP Address List
IPListMalicious Site IP Address List
IPListAmazon AMAZON sa-east-1
SituationGeneric_CS-Shared-Variable-Fingerprints
Fingerprint regexp changed

HOW TO IMPORT AND ACTIVATE THE DYNAMIC UPDATE PACKAGE

  1. Download the dynamic update package, then make sure that the checksums for the original files and the files that you have downloaded match.
  2. In the Management Client, select Menu > File > Import > Import Update Packages.
  3. Browse to the file, select it, then click Import.
  4. Select  Configuration, then browse to Administration > Other Elements > Updates.
  5. Right-click the imported dynamic update package, then select Activate.
  6. When the activation is finished, refresh the policy on all NGFW Engines. If your policy uses a custom template, you might need to edit the policy.

DISCLAIMER AND COPYRIGHT

Copyright © 2022 Forcepoint
Forcepoint and the FORCEPOINT logo are trademarks of Forcepoint.

All other trademarks used in this document are the property of their respective owners.

Every effort has been made to ensure the accuracy of this document. However, Forcepoint makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Forcepoint shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice.