Release notes for update package 1542-5242

This update package improves the detection capabilities of the Forcepoint NGFW system.

RELEASE DATE:	Thursday January 05, 2023
MD5 CHECKSUM:	7328598c29c56acb1c4c9e78e266403a
SHA1 CHECKSUM:	900df351af9574638eb046733b744dc4a89d9aee
SHA256 CHECKSUM:	432a0d052058ee5bd4c29efd324f622ece24d756daa6e2ee449bf94e4d48e08b

UPDATE CRITICALITY: HIGH

MINIMUM SOFTWARE VERSIONS

- Forcepoint NGFW Security Management Center:	6.5.1.10631
- Forcepoint NGFW:	6.3.1.19034

List of detected attacks in this update package:

Risk level	Description	Reference	Vulnerability
High	An attempt to exploit a vulnerability in D-Link DSL-2750B detected	CVE-2016-20017	D-Link-DSL-2750B-Command-Injection
High	An attempt to exploit a vulnerability in JasperReports Server detected	CVE-2018-5430	JasperSoft-JasperReports-Server-Information-Disclosure-CVE-2018-5430
High	An attempt to exploit a vulnerability in JasperReports Server detected	CVE-2018-18809	JasperSoft-JasperReports-Server-Path-Traversal-CVE-2018-18809
High	An attempt to exploit a vulnerability in Microsoft Visual Studio Code detected	CVE-2022-41034	Windows-Visual-Studio-Code-Jupyter-Notebook-Remote-Code-Execution
High	An attempt to exploit a vulnerability in Zoho Corporation ManageEngine ServiceDesk Plus detected	CVE-2022-40770	Zoho-Manageengine-Multiple-Products-Invokedatauploadtool-Command-Injection
High	An attempt to exploit a vulnerability in Zoho Corporation ManageEngine Access Manager Plus detected	CVE-2022-43671	Zoho-Manageengine-Password-Manager-Pro-Landingserverfilter-SQL-Injection
High	An attempt to exploit a vulnerability in Centreon Project Centreon Web detected	CVE-2022-42427	Centreon-Web-Formcontactgroup-SQL-Injection

Jump to: Detected Attacks Other Changes

DETECTED ATTACKS

New detected attacks:

HTTP Request URI

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	D-Link-DSL-2750B-Command-Injection	CVE-2016-20017	HTTP_CSU-D-Link-DSL-2750B-Command-Injection	Suspected Compromise
High	JasperSoft-JasperReports-Server-Information-Disclosure-CVE-2018-5430	CVE-2018-5430	HTTP_CSU-JasperSoft-JasperReports-Server-Information-Disclosure-CVE-2018-5430	Suspected Compromise
High	JasperSoft-JasperReports-Server-Path-Traversal-CVE-2018-18809	CVE-2018-18809	HTTP_CSU-JasperSoft-JasperReports-Server-Path-Traversal-CVE-2018-18809	Suspected Compromise

HTTP Normalized Request-Line

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Zoho-Manageengine-Multiple-Products-Invokedatauploadtool-Command-Injection	CVE-2022-40770	HTTP_CRL-Zoho-Manageengine-Multiple-Products-Invokedatauploadtool-Command-Injection	Suspected Compromise
High	Zoho-Manageengine-Password-Manager-Pro-Landingserverfilter-SQL-Injection	CVE-2022-43671	HTTP_CRL-Zoho-Manageengine-Password-Manager-Pro-Landingserverfilter-SQL-Injection	Suspected Compromise
High	Centreon-Web-Formcontactgroup-SQL-Injection	CVE-2022-42427	HTTP_CRL-Centreon-Web-Formcontactgroup-SQL-Injection	Suspected Compromise

Text File Stream

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Windows-Visual-Studio-Code-Jupyter-Notebook-Remote-Code-Execution	CVE-2022-41034	File-Text_Windows-Visual-Studio-Code-Jupyter-Notebook-Remote-Code-Execution	Suspected Compromise

Updated detected attacks:

TCP SMB Client Stream

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Out-Of-Bound-Memory-Read-In-Smb-Kernel-Server-Ksmbd-ZDI-22-1691

CVE-2022-47940

SMB-TCP_Out-Of-Bound-Memory-Read-In-Smb-Kernel-Server-Ksmbd-ZDI-22-1691

Suspected Compromise

Category tag application ksmbd added

Category tag application JasperSoft removed

High

Use-After-Free-Vulnerability-In-Smb-Kernel-Server-Ksmbd-ZDI-22-1690

CVE-2022-47939

SMB-TCP_Use-After-Free-Vulnerability-In-Smb-Kernel-Server-Ksmbd-ZDI-22-1690

Suspected Compromise

Category tag application ksmbd added

Category tag application JasperSoft removed

LIST OF OTHER CHANGES:

New objects:

Type	Name
Category	Zoho Corporation ManageEngine SupportCenter
Category	ksmbd

Updated objects:

Type	Name	Changes
Category	JasperSoft
IPList	TOR exit nodes IP Address List
IPList	Amazon AMAZON
IPList	Amazon S3
IPList	Amazon EC2
IPList	TOR relay nodes IP Address List
IPList	Amazon AMAZON af-south-1
IPList	Botnet IP Address List
IPList	Malicious Site IP Address List
IPList	Amazon S3 cn-north-1
IPList	Amazon AMAZON eu-west-1
IPList	Amazon AMAZON eu-west-2
IPList	Amazon AMAZON us-east-1
IPList	Amazon EC2 us-east-1

HOW TO IMPORT AND ACTIVATE THE DYNAMIC UPDATE PACKAGE

Download the dynamic update package, then make sure that the checksums for the original files and the files that you have downloaded match.
In the Management Client, select Menu > File > Import > Import Update Packages.
Browse to the file, select it, then click Import.
Select Configuration, then browse to Administration > Other Elements > Updates.
Right-click the imported dynamic update package, then select Activate.
When the activation is finished, refresh the policy on all NGFW Engines. If your policy uses a custom template, you might need to edit the policy.

DISCLAIMER AND COPYRIGHT

Copyright © 2023 Forcepoint
Forcepoint and the FORCEPOINT logo are trademarks of Forcepoint.

All other trademarks used in this document are the property of their respective owners.

Every effort has been made to ensure the accuracy of this document. However, Forcepoint makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Forcepoint shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice.