Release notes for update package 1580-5242

This update package improves the detection capabilities of the Forcepoint NGFW system.

RELEASE DATE:	Tuesday April 25, 2023
MD5 CHECKSUM:	587d838dc207193b9531dac97f889bcf
SHA1 CHECKSUM:	16818d3f96c65e2af642d3346499be80e24bdcbc
SHA256 CHECKSUM:	0b7927528fbbdb7566cb83f70d5daab20d3d35deb116d725eae926dded448802

UPDATE CRITICALITY: HIGH

MINIMUM SOFTWARE VERSIONS

- Forcepoint NGFW Security Management Center:	6.5.1.10631
- Forcepoint NGFW:	6.3.1.19034

List of detected attacks in this update package:

Risk level	Description	Reference	Vulnerability
High	An attempt to exploit a vulnerability in Oracle WebLogic Server detected	CVE-2014-4210	Server-Side-Request-Forgery-In-Oracle-WebLogic-Server-CVE-2014-4210
High	An attempt to exploit a vulnerability in SmartScreen detected	CVE-2023-24880	SmartScreen-Security-warning-Bypass-For-MSI-Files-CVE-2023-24880
High	An attempt to exploit a vulnerability in rConfig Network Device Configuration Tool detected	CVE-2022-45030	rConfig-Network-Device-Configuration-Ajaxcomparegetcmddates-SQL-Injection
High	An attempt to exploit a vulnerability in Adobe Systems Commerce detected	CVE-2023-22249	Adobe-Commerce-And-Magento-Open-Source-group.php-Cross-Site-Scripting
High	An attempt to exploit a vulnerability in Veritas Software NetBackup detected	CVE-2021-27877	Veritas-Backup-Exec-Agent-Improper-Authentication-Vulnerability-CVE-2021-27877
High	An attempt to exploit a vulnerability in Windows Kerberos detected	CVE-2022-33679	Windows-Kerberos-Elevation-Of-Privilege-Vulnerability-CVE-2022-33679
High	An attempt to exploit a vulnerability in Inductive Automation Ignition detected	CVE-2022-35870	Inductive-Automation-Ignition-Servermessage-Insecure-Deserialization
High	An attempt to exploit a vulnerability in ClamAV Project ClamAV detected	CVE-2023-20052	Clamav-DMG-CLI_scandmg-External-Entity-Injection

Jump to: Detected Attacks Other Changes

DETECTED ATTACKS

New detected attacks:

TCP Client Stream Unknown

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Veritas-Backup-Exec-Agent-Improper-Authentication-Vulnerability-CVE-2021-27877	CVE-2021-27877	Generic_CS-Veritas-Backup-Exec-Agent-Improper-Authentication-Vulnerability-CVE-2021-27877	Suspected Compromise
High	Windows-Kerberos-Elevation-Of-Privilege-Vulnerability-CVE-2022-33679	CVE-2022-33679	Generic_CS-Windows-Kerberos-Elevation-Of-Privilege-Vulnerability-CVE-2022-33679	Suspected Compromise

HTTP Request URI

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Server-Side-Request-Forgery-In-Oracle-WebLogic-Server-CVE-2014-4210	CVE-2014-4210	HTTP_CSU-Server-Side-Request-Forgery-In-Oracle-WebLogic-Server-CVE-2014-4210	Suspected Compromise

HTTP Normalized Request-Line

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	rConfig-Network-Device-Configuration-Ajaxcomparegetcmddates-SQL-Injection	CVE-2022-45030	HTTP_CRL-rConfig-Network-Device-Configuration-Ajaxcomparegetcmddates-SQL-Injection	Suspected Compromise
High	Adobe-Commerce-And-Magento-Open-Source-group.php-Cross-Site-Scripting	CVE-2023-22249	HTTP_CRL-Adobe-Commerce-And-Magento-Open-Source-group.php-Cross-Site-Scripting	Potential Compromise

Text File Stream

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	SmartScreen-Security-warning-Bypass-For-MSI-Files-CVE-2023-24880	CVE-2023-24880	File-Text_SmartScreen-Security-warning-Bypass-For-Script-Files-CVE-2023-24880	Suspected Compromise

Other Binary File Stream

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Inductive-Automation-Ignition-Servermessage-Insecure-Deserialization	CVE-2022-35870	File-Binary_Inductive-Automation-Ignition-Servermessage-Insecure-Deserialization	Suspected Compromise
High	Clamav-DMG-CLI_scandmg-External-Entity-Injection	CVE-2023-20052	File-Binary_Clamav-DMG-CLI_scandmg-External-Entity-Injection	Suspected Compromise

Updated detected attacks:

HTTP Client Stream

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Inductive-Automation-Ignition-Servermessageheader-Insecure-Deserialization

CVE-2020-12000

HTTP_CS-Inductive-Automation-Ignition-Servermessageheader-Insecure-Deserialization

Suspected Compromise

Fingerprint regexp changed

TCP SMB Client Stream

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Microsoft_Windows_SMBv3_Remote_Code_Execution_Vulnerability_CVE-2020-0796

CVE-2020-0796

SMB-TCP_Microsoft_Windows_SMBv3_Remote_Code_Execution_Vulnerability_CVE-2020-0796

Potential Compromise

Detection mechanism updated

TCP Client Stream Unknown

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Git-Git-Source-Code-Management-gitattributes-Integer-Overflow

CVE-2022-23521

Generic_CS-Git-Git-Source-Code-Management-gitattributes-Integer-Overflow

Potential Compromise

Detection mechanism updated

HTTP Request URI

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Arcadyan-Firmware-Path-Traversal-CVE-2021-20090

CVE-2021-20090

HTTP_CSU-Arcadyan-Firmware-Path-Traversal-CVE-2021-20090

Suspected Compromise

Description has changed

Fingerprint regexp changed

Text File Stream

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Microsoft-Windows-SmartScreen-Security-Feature-Bypass-CVE-2022-44698

CVE-2022-44698

File-Text_Microsoft-Windows-SmartScreen-Security-Feature-Bypass-CVE-2022-44698

Potential Compromise

Detection mechanism updated

Other Binary File Stream

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Ysoserial-Generated-Java-Serialized-Object

No CVE/CAN

File-Binary_Ysoserial-Generated-Java-Serialized-Object

Suspected Compromise

Fingerprint regexp changed

Identified Text File Stream

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Schneider-Electric-IGSS-DashBoard.exe-Insecure-Deserialization

CVE-2023-27978

File-TextId_Schneider-Electric-IGSS-DashBoard.exe-Insecure-Deserialization

Potential Compromise

Fingerprint regexp changed

Executable File Stream

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

SmartScreen-Security-warning-Bypass-For-MSI-Files-CVE-2023-24880

CVE-2023-24880

File-Exe_SmartScreen-Security-warning-Bypass-For-PE-Files-CVE-2023-24880

Suspected Compromise

Detection mechanism updated

LIST OF OTHER CHANGES:

Updated objects:

Type	Name	Changes
IPList	Saudi Arabia
IPList	Iran
IPList	Tanzania
IPList	Seychelles
IPList	United Arab Emirates
IPList	Israel
IPList	Turkey
IPList	Egypt
IPList	Greece
IPList	Estonia
IPList	Latvia
IPList	Azerbaijan
IPList	Lithuania
IPList	Georgia
IPList	Moldova
IPList	Finland
IPList	Ukraine
IPList	Hungary
IPList	Bulgaria
IPList	Poland
IPList	Romania
IPList	Kosovo
IPList	South Africa
IPList	Afghanistan
IPList	Pakistan
IPList	Bangladesh
IPList	India
IPList	Myanmar
IPList	Uzbekistan
IPList	Kazakhstan
IPList	Vietnam
IPList	Thailand
IPList	Indonesia
IPList	Laos
IPList	Taiwan
IPList	Philippines
IPList	Malaysia
IPList	China
IPList	Hong Kong
IPList	Cambodia
IPList	South Korea
IPList	Japan
IPList	Singapore
IPList	Russia
IPList	Australia
IPList	New Zealand
IPList	Portugal
IPList	Spain
IPList	Denmark
IPList	Iceland
IPList	United Kingdom
IPList	Switzerland
IPList	Sweden
IPList	Netherlands
IPList	Austria
IPList	Belgium
IPList	Germany
IPList	Luxembourg
IPList	Ireland
IPList	France
IPList	Liechtenstein
IPList	Isle of Man
IPList	Slovakia
IPList	Czechia
IPList	Norway
IPList	Vatican City
IPList	San Marino
IPList	Italy
IPList	Slovenia
IPList	Montenegro
IPList	Croatia
IPList	Saint Pierre and Miquelon
IPList	Greenland
IPList	Uruguay
IPList	Brazil
IPList	Dominican Republic
IPList	Cuba
IPList	Honduras
IPList	Costa Rica
IPList	Venezuela
IPList	Colombia
IPList	Panama
IPList	Argentina
IPList	Chile
IPList	Peru
IPList	Mexico
IPList	Canada
IPList	United States
IPList	Palestine
IPList	Serbia
IPList	TOR exit nodes IP Address List
IPList	Amazon AMAZON
IPList	Spotify
IPList	Amazon EC2
IPList	Akamai Servers
IPList	TOR relay nodes IP Address List
IPList	Linode Servers
IPList	Amazon AMAZON ap-northeast-1
IPList	Amazon EC2 ap-northeast-1
IPList	Amazon AMAZON ap-northeast-2
IPList	Amazon EC2 ap-northeast-2
IPList	Amazon AMAZON ap-northeast-3
IPList	Amazon EC2 ap-northeast-3
IPList	Botnet IP Address List
IPList	Malicious Site IP Address List
IPList	Amazon AMAZON ap-southeast-1
IPList	Amazon EC2 ap-southeast-1
IPList	NordVPN Servers IP Address List
IPList	Amazon AMAZON ap-southeast-2
IPList	Amazon EC2 ap-southeast-2
IPList	Amazon AMAZON ca-central-1
IPList	Amazon EC2 ca-central-1
IPList	Amazon AMAZON eu-central-1
IPList	Amazon EC2 eu-central-1
IPList	Amazon AMAZON eu-north-1
IPList	Amazon EC2 eu-north-1
IPList	Amazon AMAZON eu-west-1
IPList	Amazon EC2 eu-west-1
IPList	Amazon AMAZON eu-west-2
IPList	Amazon EC2 eu-west-2
IPList	Amazon AMAZON eu-west-3
IPList	Amazon EC2 eu-west-3
IPList	Amazon AMAZON sa-east-1
IPList	Amazon EC2 sa-east-1
IPList	Amazon AMAZON us-east-1
IPList	Amazon EC2 us-east-1
IPList	Amazon AMAZON us-east-2
IPList	Amazon EC2 us-east-2
IPList	Amazon AMAZON us-west-1
IPList	Amazon EC2 us-west-1
IPList	Amazon AMAZON us-west-2
IPList	Amazon EC2 us-west-2
IPList	Amazon ROUTE53_RESOLVER
IPList	Amazon ROUTE53_RESOLVER ap-northeast-1
IPList	Amazon ROUTE53_RESOLVER eu-central-1
IPList	Amazon ROUTE53_RESOLVER us-east-1
IPList	Amazon ROUTE53_RESOLVER us-east-2
Situation	Generic_SS-Shared-Variables-Fingerprint
Situation	HTTP_CSU-Shared-Variables
Situation	SMB-TCP_CHS-SMB3-Negotiate-Chained-Compression-Supported
Situation	File-Name_Shared-Variables

HOW TO IMPORT AND ACTIVATE THE DYNAMIC UPDATE PACKAGE

Download the dynamic update package, then make sure that the checksums for the original files and the files that you have downloaded match.
In the Management Client, select Menu > File > Import > Import Update Packages.
Browse to the file, select it, then click Import.
Select Configuration, then browse to Administration > Other Elements > Updates.
Right-click the imported dynamic update package, then select Activate.
When the activation is finished, refresh the policy on all NGFW Engines. If your policy uses a custom template, you might need to edit the policy.

DISCLAIMER AND COPYRIGHT

Copyright © 2023 Forcepoint
Forcepoint and the FORCEPOINT logo are trademarks of Forcepoint.

All other trademarks used in this document are the property of their respective owners.

Every effort has been made to ensure the accuracy of this document. However, Forcepoint makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Forcepoint shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice.