Release notes for update package 1563-5242

This update package improves the detection capabilities of the Forcepoint NGFW system.

RELEASE DATE:	Wednesday March 08, 2023
MD5 CHECKSUM:	7d7a9d79304d69781d03da460bdfa4ea
SHA1 CHECKSUM:	d63cab5c578eeeda34a6b8be7873ad870b627535
SHA256 CHECKSUM:	dd00640a0fed32020802ef6630b765b20f3862d3a21b4121fb82e287c55585a7

UPDATE CRITICALITY: HIGH

MINIMUM SOFTWARE VERSIONS

- Forcepoint NGFW Security Management Center:	6.5.1.10631
- Forcepoint NGFW:	6.3.1.19034

List of detected attacks in this update package:

Risk level	Description	Reference	Vulnerability
High	An attempt to exploit a vulnerability in Jenkins Pipeline: Build Step Plugin detected	CVE-2023-25762	Jenkins-Pipeline-Build-Step-Plugin-Job-Name-Stored-Cross-Site-Scripting
High	An attempt to exploit a vulnerability in Microsoft Word detected	CVE-2023-21716	Microsoft-Word-Font-Table-Remote-Code-Execution-CVE-2023-21716

Jump to: Detected Attacks Other Changes

DETECTED ATTACKS

New detected attacks:

HTTP Normalized Request-Line

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Jenkins-Pipeline-Build-Step-Plugin-Job-Name-Stored-Cross-Site-Scripting	CVE-2023-25762	HTTP_CRL-Jenkins-Pipeline-Build-Step-Plugin-Job-Name-Stored-Cross-Site-Scripting	Suspected Compromise

RTF File Stream

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Microsoft-Word-Font-Table-Remote-Code-Execution-CVE-2023-21716	CVE-2023-21716	File-RTF_Microsoft-Word-Font-Table-Remote-Code-Execution-CVE-2023-21716	Suspected Compromise

Updated detected attacks:

HTTP Normalized Request-Line

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Adobe-ColdFusion-Application-Server-CVE-2022-38418-Directory-Traversal

CVE-2022-38418

HTTP_CRL-Adobe-ColdFusion-Application-Server-CVE-2022-38418-Directory-Traversal

Suspected Compromise

Name: HTTP_CS-Adobe-ColdFusion-Application-Server-CVE-2022-38418-Directory-Traversal->HTTP_CRL-Adobe-ColdFusion-Application-Server-CVE-2022-38418-Directory-Traversal

Category tag group TCP Correlation Dependency Group removed

Context has changed from HTTP Client Stream to HTTP Normalized Request-Line

TLS Server Stream

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

Low

SSL-Certificate-In-Nonstandard-Port

No CVE/CAN

TLS_SS-SSL-Certificate-In-Nonstandard-Port

Protocol Information

Detection mechanism updated

LIST OF OTHER CHANGES:

Updated objects:

Type

Name

Changes

IPList

TOR exit nodes IP Address List

IPList

Amazon AMAZON

IPList

Amazon EC2

IPList

TOR relay nodes IP Address List

IPList

Amazon WORKSPACES_GATEWAYS

IPList

Amazon AMAZON ap-northeast-1

IPList

Botnet IP Address List

IPList

Malicious Site IP Address List

IPList

NordVPN Servers IP Address List

IPList

Amazon WORKSPACES_GATEWAYS us-east-1

IPList

Amazon AMAZON us-east-2

IPList

Amazon EC2 us-east-2

IPList

Google Cloud IP Address List for europe-southwest1

IPList

Google Cloud IP Address List for us-central1

Application

Facebook

Application detection context content changed

Application

Linode-Infrastructure

Application detection context content changed

Application

Apple-Infrastructure

Application detection context content changed

HOW TO IMPORT AND ACTIVATE THE DYNAMIC UPDATE PACKAGE

Download the dynamic update package, then make sure that the checksums for the original files and the files that you have downloaded match.
In the Management Client, select Menu > File > Import > Import Update Packages.
Browse to the file, select it, then click Import.
Select Configuration, then browse to Administration > Other Elements > Updates.
Right-click the imported dynamic update package, then select Activate.
When the activation is finished, refresh the policy on all NGFW Engines. If your policy uses a custom template, you might need to edit the policy.

DISCLAIMER AND COPYRIGHT

Copyright © 2023 Forcepoint
Forcepoint and the FORCEPOINT logo are trademarks of Forcepoint.

All other trademarks used in this document are the property of their respective owners.

Every effort has been made to ensure the accuracy of this document. However, Forcepoint makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Forcepoint shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice.