Release notes for update package 1515-5242

This update package improves the detection capabilities of the Forcepoint NGFW system.

RELEASE DATE:    Monday October 17, 2022
MD5 CHECKSUM:    f10ada08e2003e2ccfd675558808e0e8
SHA1 CHECKSUM:    b8e5068923231acb2bda9a1e82f3efa36d717c11
SHA256 CHECKSUM:    17989d344b1359aea5995b3faf2ddd5688c38fe76d726cc7b7e8fbcaa45e93ca

UPDATE CRITICALITY:    HIGH

MINIMUM SOFTWARE VERSIONS
- Forcepoint NGFW Security Management Center:    6.5.1.10631
- Forcepoint NGFW:    6.3.1.19034

List of detected attacks in this update package:

Risk levelDescriptionReferenceVulnerability
High     An attempt to exploit a vulnerability in Advantech iView detected     CVE-2022-3323     Advantech-Iview-Configurationservlet-Column_Value-SQL-Injection
High     An attempt to exploit a vulnerability in Zimbra Collaboration Suite detected     CVE-2022-41352     Remote-Code-Execution-Via-Cpio-In-Zimbra-Collaboration-Suite-CVE-2022-41352

Jump to: Detected Attacks

DETECTED ATTACKS

New detected attacks:

HTTP Normalized Request-Line

RiskVulnerability/SituationReferencesRelated FingerprintSituation Type
High Advantech-Iview-Configurationservlet-Column_Value-SQL-Injection CVE-2022-3323 HTTP_CRL-Advantech-Iview-Configurationservlet-Column_Value-SQL-Injection Suspected Compromise

Other Binary File Stream

RiskVulnerability/SituationReferencesRelated FingerprintSituation Type
High Remote-Code-Execution-Via-Cpio-In-Zimbra-Collaboration-Suite-CVE-2022-41352 CVE-2022-41352 File-Binary_Remote-Code-Execution-Via-Cpio-In-Zimbra-Collaboration-Suite-CVE-2022-41352 Suspected Compromise

Updated detected attacks:

Identified Text File Stream

RiskVulnerability/SituationReferencesRelated FingerprintSituation TypeChange Description
High Microsoft_Exchange_Server-Insecure_Deserialization_Vulnerability_CVE-2021-28482 CVE-2021-28482 File-TextId_Microsoft_Exchange_Server-Remote_Code_Execution_CVE-2021-28482 Suspected Compromise
Detection mechanism updated
High Belkin-Wemo-UPnP-RCE-CVE-2018-6692 CVE-2018-6692 File-TextId_Belkin-Wemo-UPnP-RCE-CVE-2018-6692 Suspected Compromise
Fingerprint regexp changed
High Zoho-Manageengine-Servicedesk-Plus-Wsdiscoveryservlet-Stored-XSS CVE-2021-20080 File-TextId_Zoho-Manageengine-Servicedesk-Plus-Wsdiscoveryservlet-Stored-XSS Suspected Compromise
Fingerprint regexp changed
High Oracle-Business-Intelligence-CVE-2021-2401-Xdo-Xml-External-Entity-Injection CVE-2021-2401 File-TextId_Oracle-Business-Intelligence-CVE-2021-2401-Xdo-Xml-External-Entity-Injection Suspected Compromise
Fingerprint regexp changed
High Safari-Stack-Based-Out-Of-Bounds CVE-2020-27930 File-TextId_Safari-Stack-Based-Out-Of-Bounds Suspected Compromise
Fingerprint regexp changed
High Microsoft-Exchange-Deserialization-Remote-Code-Execution CVE-2021-42321 File-TextId_Microsoft-Exchange-Deserialization-Remote-Code-Execution Suspected Compromise
Fingerprint regexp changed
High Apache-Log4j-JDBC-Appender-JNDI-Injection CVE-2021-44832 File-TextId_Apache-Log4j-JDBC-Appender-JNDI-Injection Suspected Compromise
Fingerprint regexp changed
High Wecon-LeviStudioU-Baseset-Hminame-Stack-Buffer-Overflow CVE-2021-43983 File-TextId_Wecon-LeviStudioU-Baseset-Hminame-Stack-Buffer-Overflow Suspected Compromise
Fingerprint regexp changed
High Wecon-LeviStudioU-Trend-WordAddr-Stack-Buffer-Overflow CVE-2021-43983 File-TextId_Wecon-LeviStudioU-Trend-WordAddr-Stack-Buffer-Overflow Suspected Compromise
Fingerprint regexp changed
High Wecon-LeviStudioU-Address-Mapping-Plcaddr-And-Dstaddr-Stack-Buffer-Overflow CVE-2021-23138 File-TextId_Wecon-LeviStudioU-Address-Mapping-Plcaddr-And-Dstaddr-Stack-Buffer-Overflow Suspected Compromise
Fingerprint regexp changed
High Wecon-LeviStudioU-Address-Mapping-Digitcount-Stack-Buffer-Overflow CVE-2021-23138 File-TextId_Wecon-LeviStudioU-Address-Mapping-Digitcount-Stack-Buffer-Overflow Suspected Compromise
Fingerprint regexp changed
High Wecon-LeviStudioU-Baseset-Scridwordaddr-Stack-Buffer-Overflow CVE-2021-43983 File-TextId_Wecon-LeviStudioU-Baseset-Scridwordaddr-Stack-Buffer-Overflow Suspected Compromise
Fingerprint regexp changed
High Wecon-LeviStudioU-Screeninfo-Scrnfile-Heap-Buffer-Overflow CVE-2021-23157 File-TextId_Wecon-LeviStudioU-Screeninfo-Scrnfile-Heap-Buffer-Overflow Suspected Compromise
Fingerprint regexp changed

HOW TO IMPORT AND ACTIVATE THE DYNAMIC UPDATE PACKAGE

  1. Download the dynamic update package, then make sure that the checksums for the original files and the files that you have downloaded match.
  2. In the Management Client, select Menu > File > Import > Import Update Packages.
  3. Browse to the file, select it, then click Import.
  4. Select  Configuration, then browse to Administration > Other Elements > Updates.
  5. Right-click the imported dynamic update package, then select Activate.
  6. When the activation is finished, refresh the policy on all NGFW Engines. If your policy uses a custom template, you might need to edit the policy.

DISCLAIMER AND COPYRIGHT

Copyright © 2022 Forcepoint
Forcepoint and the FORCEPOINT logo are trademarks of Forcepoint.

All other trademarks used in this document are the property of their respective owners.

Every effort has been made to ensure the accuracy of this document. However, Forcepoint makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Forcepoint shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice.