Release notes for update package 1502-5242

This update package improves the detection capabilities of the Forcepoint NGFW system.

RELEASE DATE:	Thursday September 08, 2022
MD5 CHECKSUM:	16841e4efe9098ce94fef3215078a385
SHA1 CHECKSUM:	d684e6c7f8d3820106fd13447f2201eaebafc091
SHA256 CHECKSUM:	b8bf5fabd19d3344a75260b4e09797247474a292498cb42582a500cbf1d5647e

UPDATE CRITICALITY: HIGH

MINIMUM SOFTWARE VERSIONS

- Forcepoint NGFW Security Management Center:	6.5.1.10631
- Forcepoint NGFW:	6.3.1.19034

List of detected attacks in this update package:

Risk level	Description	Reference	Vulnerability
High	An attempt to exploit a vulnerability in Jetty detected	CVE-2021-28169	Jetty-File-Disclosure-CVE-2021-28169
High	An attempt to exploit a vulnerability in Oracle WebLogic Server detected	CVE-2022-21371	Oracle-WebLogic-Server-Local-File-Inclusion-CVE-2022-21371
High	An attempt to exploit a vulnerability in NetGear RAX43 router detected	CVE-2021-20167	NetGear-RAX43-Command-Injection-CVE-2021-20167
High	An attempt to exploit a vulnerability in BeyondTrust Remote Support detected	CVE-2021-31589	Beyondtrust-Remote-Support-Cross-Site-Scripting-CVE-2021-31589
High	An attempt to exploit a vulnerability in Watchguard	CVE-2022-26318	Watchguard-Pre-Auth-RCE-CVE-2022-26318
High	An attempt to exploit a vulnerability in Confluence detected	CVE-2022-26138	Confluence-Hardcoded-Credentials-CVE-2022-26138
High	An attempt to exploit a vulnerability in OpenEMR Development Team OpenEMR detected	CVE-2022-2733	Openemr-Fee_Sheet_Options_Ajax-Reflected-Cross-Site-Scripting
High	An attempt to exploit a vulnerability in D-Link DIR816L detected	CVE-2022-28958	D-Link-DIR816L-Remote-Code-Execution-CVE-2022-28958
High	An attempt to exploit a vulnerability in Microsoft Windows Network File System detected.	CVE-2022-34715	Microsoft-Windows-NFS-CVE-2022-34715-RCE-Vulnerability
High	An attempt to exploit a vulnerability in Oracle MySQL Cluster detected.	CVE-2022-21489	Oracle-MySQL-Cluster-GSN_CREATE_FRAGMENTATION_REQ-Buffer-Overflow
Low	An attempt to exploit a vulnerability in Microsoft Internet Information Services detected.	CVE-2022-22025	Microsoft-IIS-Cachuri-Tree_Hash_Table-Denial-of-Service

Jump to: Detected Attacks Other Changes

DETECTED ATTACKS

New detected attacks:

TCP Client Stream Unknown

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Microsoft-Windows-NFS-CVE-2022-34715-RCE-Vulnerability	CVE-2022-34715	Generic_CS-Microsoft-Windows-NFS-CVE-2022-34715-RCE-Vulnerability	Suspected Compromise
High	Oracle-MySQL-Cluster-GSN_CREATE_FRAGMENTATION_REQ-Buffer-Overflow	CVE-2022-21489	Generic_CS-Oracle-MySQL-Cluster-GSN_CREATE_FRAGMENTATION_REQ-Buffer-Overflow	Potential Compromise

HTTP Request URI

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
Low	Microsoft-IIS-Cachuri-Tree_Hash_Table-Denial-of-Service	CVE-2022-22025	HTTP_CSU-Microsoft-IIS-Cachuri-Tree_Hash_Table-Denial-of-Service	Potential Denial of Service
High	Jetty-File-Disclosure-CVE-2021-28169	CVE-2021-28169	HTTP_CSU-Jetty-File-Disclosure-CVE-2021-28169	Suspected Compromise
High	Oracle-WebLogic-Server-Local-File-Inclusion-CVE-2022-21371	CVE-2022-21371	HTTP_CSU-Oracle-WebLogic-Server-Local-File-Inclusion-CVE-2022-21371	Potential Compromise

HTTP Normalized Request-Line

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	NetGear-RAX43-Command-Injection-CVE-2021-20167	CVE-2021-20167	HTTP_CRL-NetGear-RAX43-Command-Injection-CVE-2021-20167	Suspected Compromise
High	Beyondtrust-Remote-Support-Cross-Site-Scripting-CVE-2021-31589	CVE-2021-31589	HTTP_CRL-Beyondtrust-Remote-Support-Cross-Site-Scripting-CVE-2021-31589	Suspected Compromise
High	Watchguard-Pre-Auth-RCE-CVE-2022-26318	CVE-2022-26318	HTTP_CRL-Watchguard-Pre-Auth-RCE-CVE-2022-26318	Suspected Compromise
High	Confluence-Hardcoded-Credentials-CVE-2022-26138	CVE-2022-26138	HTTP_CRL-Confluence-Hardcoded-Credentials-CVE-2022-26138	Suspected Compromise
High	Openemr-Fee_Sheet_Options_Ajax-Reflected-Cross-Site-Scripting	CVE-2022-2733	HTTP_CRL-Openemr-Fee_Sheet_Options_Ajax-Reflected-Cross-Site-Scripting	Suspected Compromise
High	D-Link-DIR816L-Remote-Code-Execution-CVE-2022-28958	CVE-2022-28958	HTTP_CRL-D-Link-DIR816L-Remote-Code-Execution-CVE-2022-28958	Suspected Compromise

Updated detected attacks:

HTTP Normalized Request-Line

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Advantech-Iview-Devicetreetable-Exporttaskmgrreport-Directory-Traversal

CVE-2020-16245

HTTP_CRL-Advantech-Iview-Devicetreetable-Exporttaskmgrreport-Directory-Traversal

Suspected Compromise

Fingerprint regexp changed

High

Sophos-Firewall-Authentication-Bypass-CVE-2022-1040

CVE-2022-1040

HTTP_CRL-Sophos-Firewall-Authentication-Bypass-CVE-2022-1040

Suspected Compromise

Fingerprint regexp changed

LIST OF OTHER CHANGES:

New objects:

Type	Name
Category	Watchguard
Category	BeyondTrust Remote Support
Certificate Authority	GlobalSign RSA DV SSL CA - 2018 int
Certificate Authority	GlobalSign GCC R3 DV TLS CA 2020 int
Certificate Authority	Entrust Certification Authority - L1M int

Updated objects:

Type	Name	Changes
IPList	Somalia
IPList	Iraq
IPList	Saudi Arabia
IPList	Iran
IPList	Cyprus
IPList	Armenia
IPList	Kenya
IPList	DR Congo
IPList	Uganda
IPList	Seychelles
IPList	Jordan
IPList	Lebanon
IPList	Kuwait
IPList	Oman
IPList	Qatar
IPList	Bahrain
IPList	United Arab Emirates
IPList	Israel
IPList	Turkey
IPList	Greece
IPList	Estonia
IPList	Latvia
IPList	Azerbaijan
IPList	Lithuania
IPList	Moldova
IPList	Belarus
IPList	Finland
IPList	Åland
IPList	Ukraine
IPList	Hungary
IPList	Bulgaria
IPList	Albania
IPList	Poland
IPList	Romania
IPList	Kosovo
IPList	Zimbabwe
IPList	Botswana
IPList	Mauritius
IPList	Eswatini
IPList	Réunion
IPList	South Africa
IPList	Mayotte
IPList	Afghanistan
IPList	Pakistan
IPList	Bangladesh
IPList	Tajikistan
IPList	Sri Lanka
IPList	India
IPList	Nepal
IPList	Myanmar
IPList	Uzbekistan
IPList	Kazakhstan
IPList	Kyrgyzstan
IPList	Vietnam
IPList	Thailand
IPList	Indonesia
IPList	Taiwan
IPList	Philippines
IPList	Malaysia
IPList	China
IPList	Hong Kong
IPList	Macao
IPList	Cambodia
IPList	South Korea
IPList	Japan
IPList	North Korea
IPList	Singapore
IPList	Russia
IPList	Australia
IPList	Papua New Guinea
IPList	New Zealand
IPList	Fiji
IPList	Congo Republic
IPList	Portugal
IPList	Ivory Coast
IPList	Nigeria
IPList	Togo
IPList	Gibraltar
IPList	Gambia
IPList	Spain
IPList	Malta
IPList	Faroe Islands
IPList	Denmark
IPList	Iceland
IPList	United Kingdom
IPList	Switzerland
IPList	Sweden
IPList	Netherlands
IPList	Austria
IPList	Belgium
IPList	Germany
IPList	Luxembourg
IPList	Ireland
IPList	France
IPList	Andorra
IPList	Liechtenstein
IPList	Jersey
IPList	Isle of Man
IPList	Guernsey
IPList	Slovakia
IPList	Czechia
IPList	Norway
IPList	Italy
IPList	Slovenia
IPList	Croatia
IPList	Bosnia and Herzegovina
IPList	Namibia
IPList	Barbados
IPList	French Guiana
IPList	Paraguay
IPList	Uruguay
IPList	Brazil
IPList	Jamaica
IPList	Dominican Republic
IPList	Martinique
IPList	Bahamas
IPList	Anguilla
IPList	St Kitts and Nevis
IPList	Dominica
IPList	Antigua and Barbuda
IPList	Saint Lucia
IPList	Turks and Caicos Islands
IPList	British Virgin Islands
IPList	St Vincent and Grenadines
IPList	Montserrat
IPList	Saint Martin
IPList	Saint Barthélemy
IPList	Guadeloupe
IPList	Grenada
IPList	Cayman Islands
IPList	Belize
IPList	El Salvador
IPList	Guatemala
IPList	Honduras
IPList	Nicaragua
IPList	Costa Rica
IPList	Venezuela
IPList	Ecuador
IPList	Colombia
IPList	Panama
IPList	Argentina
IPList	Chile
IPList	Bolivia
IPList	Peru
IPList	Mexico
IPList	Samoa
IPList	Northern Mariana Islands
IPList	Guam
IPList	Puerto Rico
IPList	U.S. Virgin Islands
IPList	American Samoa
IPList	Canada
IPList	United States
IPList	Palestine
IPList	Serbia
IPList	Sint Maarten
IPList	Curaçao
IPList	Bonaire, Sint Eustatius, and Saba
IPList	TOR exit nodes IP Address List
IPList	Amazon AMAZON
IPList	TOR relay nodes IP Address List
IPList	Botnet IP Address List
IPList	Malicious Site IP Address List
IPList	Amazon AMAZON eu-central-1
IPList	Amazon AMAZON eu-north-1
IPList	Amazon AMAZON eu-west-2
IPList	Amazon AMAZON us-east-1

HOW TO IMPORT AND ACTIVATE THE DYNAMIC UPDATE PACKAGE

Download the dynamic update package, then make sure that the checksums for the original files and the files that you have downloaded match.
In the Management Client, select Menu > File > Import > Import Update Packages.
Browse to the file, select it, then click Import.
Select Configuration, then browse to Administration > Other Elements > Updates.
Right-click the imported dynamic update package, then select Activate.
When the activation is finished, refresh the policy on all NGFW Engines. If your policy uses a custom template, you might need to edit the policy.

DISCLAIMER AND COPYRIGHT

Copyright © 2022 Forcepoint
Forcepoint and the FORCEPOINT logo are trademarks of Forcepoint.

All other trademarks used in this document are the property of their respective owners.

Every effort has been made to ensure the accuracy of this document. However, Forcepoint makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Forcepoint shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice.