Release notes for update package 1645-5242

This update package improves the detection capabilities of the Forcepoint NGFW system.

RELEASE DATE:	Monday October 30, 2023
MD5 CHECKSUM:	ca4d9f7f55c5b4c4ba746185be3b183c
SHA1 CHECKSUM:	d227b3dfabe2ca46e543dbbd69185e3816788415
SHA256 CHECKSUM:	1e0828762e39c708a9ae3a4bf3b4ab59344dd5b1e46b8aaf5c3f6aad1f3d6b0d

UPDATE CRITICALITY: HIGH

MINIMUM SOFTWARE VERSIONS

- Forcepoint NGFW Security Management Center:	6.5.1.10631
- Forcepoint NGFW:	6.5.1.21108

List of detected attacks in this update package:

Risk level	Description	Reference	Vulnerability
High	Attempt to exploit directory traversal vulnerability in Apache Tomcat detected	CVE-2007-0450	Apache-Tomcat-Servlet-Engine-Directory-Traversal
High	An attempt to exploit a vulnerability in Cisco SA520W detected	No CVE/CAN	Cisco-SA520W-Security-Appliance-Directory-Traversal
High	An attempt to exploit a vulnerability in a D-Link DIR-2640 device detected	CVE-2023-32153	D-Link-DIR-2640-HNAP-EmailFrom-Command-Injection-Vulnerability
High	An overly long RTSP Host header detected	No CVE/CAN	Overly-Long-RTSP-Host-Header
High	An attempt to exploit a vulnerability in Microsoft Windows detected	CVE-2023-28250	Microsoft-Windows-PGM-Handling-Remote-Code-Execution
High	An attempt to exploit a vulnerability in Microsoft Windows detected	CVE-2023-24940	Microsoft-Windows-Pragmatic-General-Multicast-Packet-Length-Integer-Underflow
High	An attempt to exploit a vulnerability in Tomcat AJP detected	CVE-2022-26377	TomcatAJP-Request-Smuggling-CVE-2022-26377

Jump to: Detected Attacks Other Changes

DETECTED ATTACKS

New detected attacks:

TCP Client Stream Unknown

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Overly-Long-RTSP-Host-Header	No CVE/CAN	Generic_CS-Overly-Long-RTSP-Host-Header	Potential Compromise

HTTP Request URI

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Apache-Tomcat-Servlet-Engine-Directory-Traversal	CVE-2007-0450	HTTP_CSU-Apache-Tomcat-Servlet-Engine-Directory-Traversal-2	Suspected Disclosure

HTTP Normalized Request-Line

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Cisco-SA520W-Security-Appliance-Directory-Traversal	No CVE/CAN	HTTP_CRL-Cisco-SA520W-Security-Appliance-Directory-Traversal	Suspected Compromise
High	D-Link-DIR-2640-HNAP-EmailFrom-Command-Injection-Vulnerability	CVE-2023-32153	HTTP_CRL-D-Link-DIR-2640-HNAP-EmailFrom-Command-Injection-Vulnerability	Suspected Compromise

Other Binary File Stream

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	TomcatAJP-Request-Smuggling-CVE-2022-26377	CVE-2022-26377	File-Binary_TomcatAJP-Request-Smuggling	Suspected Compromise

Generic IP Fingerprinting Stream

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Microsoft-Windows-PGM-Handling-Remote-Code-Execution	CVE-2023-28250	IPv4_Microsoft-Windows-PGM-Handling-Remote-Code-Execution	Suspected Compromise
High	Microsoft-Windows-Pragmatic-General-Multicast-Packet-Length-Integer-Underflow	CVE-2023-24940	IPv4_Microsoft-Windows-Pragmatic-General-Multicast-Packet-Length-Integer-Underflow	Suspected Denial of Service

Updated detected attacks:

HTTP Client Stream

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Cisco-Prime-Data-Center-Network-Manager-Fileupload-Arbitrary-File-Upload

CVE-2019-1620

HTTP_CS-Cisco-Prime-Data-Center-Network-Manager-Fileupload-Arbitrary-File-Upload

Suspected Compromise

Fingerprint regexp changed

TCP Client Stream Unknown

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

RealNetworks-Helix-Server-RTSP-Set-Parameters-Request-DoS

CVE-2009-2533

Generic_CS-RealNetworks-Helix-Server-RTSP-Set-Parameters-Request-DoS

Potential Compromise

Fingerprint regexp changed

TCP Server Stream Unknown

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Novell-Groupwise-Messenger-HTTP-Response-Handling-Stack-Overflow

CVE-2008-2703

Generic_SS-Novell-Groupwise-Messenger-HTTP-Response-Handling-Stack-Overflow

Suspected Compromise

Severity: 2->7

Category tag situation Suspected Compromise added

Category tag group TCP Correlation Dependency Group added

Category tag group Severity over 4 Correlation Dependency Group added

Category tag situation Possibly Unwanted Content removed

Fingerprint regexp changed

HTTP Request URI

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Generic-HTTP-Exploit

No CVE/CAN

HTTP_CSU-Suspicious-Request

Suspected Compromise

Detection mechanism updated

High

Directory-Traversal

No CVE/CAN

HTTP_CSU-Potential-Dot-Dot-Slash-Directory-Traversal

Potential Compromise

Fingerprint regexp changed

HTTP Request Header Line

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

Low

HTTP-Apache-Chunked-Encoding-BOF

CVE-2002-0392

HTTP_CSH-Transfer-Encoding-Chunked

Protocol Information

Fingerprint regexp changed

HTTP Normalized Request-Line

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

Low

HTTP-Novell-Groupwise-Messenger-HTTP-POST-Request-Invalid-Memory-Access

CVE-2006-4511

HTTP_CRL-Novell-Groupwise-Messenger-HTTP-POST-Request-Memory-Access-Violation

Potential Denial of Service

Description has changed

Low

HTTP-Novell-Groupwise-Messenger-HTTP-POST-Request-Invalid-Memory-Access

CVE-2006-4511

HTTP_CRL-Novell-Groupwise-Messenger-HTTP-POST-Request-Invalid-Memory-Access

Potential Denial of Service

Description has changed

High

PhpFileManager-Cmd-Parameter-Command-Execution

No CVE/CAN

HTTP_CRL-PhpFileManager-Cmd-Parameter-Command-Execution

Suspected Compromise

Fingerprint regexp changed

High

JetBrains-TeamCity-Avatar-Stored-Cross-Site-Scripting

CVE-2022-48343

HTTP_CRL-JetBrains-TeamCity-Avatar-Stored-Cross-Site-Scripting

Suspected Compromise

Fingerprint regexp changed

Text File Stream

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

JetBrains-TeamCity-Avatar-Stored-Cross-Site-Scripting

CVE-2022-48343

File-Text_JetBrains-TeamCity-Avatar-Stored-Cross-Site-Scripting

Suspected Compromise

Fingerprint regexp changed

Other Binary File Stream

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Winace-Rar-And-Tar-Directory-Traversal-Vulnerability

CVE-2006-0981

File-Binary_Path-Traversal-Via-Tar-Archive

Suspected Compromise

Description has changed

LIST OF OTHER CHANGES:

Updated objects:

Type

Name

Changes

Appliance Information

sg-3501-0-C1.svg

Appliance Information

sg-3505-0-C1.svg

Appliance Information

sg-3510-0-C1.svg

Situation

URL_List-DNS-Over-HTTPS

Detection mechanism updated

IPList

TOR exit nodes IP Address List

IPList

Amazon AMAZON

IPList

Amazon S3

IPList

Amazon EC2

IPList

TOR relay nodes IP Address List

IPList

Amazon AMAZON ap-northeast-1

IPList

Amazon EC2 ap-northeast-1

IPList

Botnet IP Address List

IPList

Malicious Site IP Address List

IPList

NordVPN Servers IP Address List

IPList

Amazon AMAZON ca-central-1

IPList

Amazon S3 cn-north-1

IPList

Amazon S3 cn-northwest-1

IPList

Amazon AMAZON eu-north-1

IPList

Amazon EC2 eu-north-1

IPList

Google Common Services IP Address List

Situation

HTTP_CS-Cisco-Data-Center-Network-Manager-RCE

Description has changed

Attacker: connection_source->none

Victim: connection_destination->none

Category tag situation Obsolete added

Category tag os Any Operating System removed

Category tag hardware Any Hardware removed

Category tag application Cisco Systems Prime Data Center Network Manager removed

Category tag group CVE2019 removed

Category tag os_not_specific Any Operating System not specific removed

Category tag situation Suspected Compromise removed

Category tag group HTTP Correlation Dependency Group removed

Category tag group TCP Correlation Dependency Group removed

Category tag group Severity over 4 Correlation Dependency Group removed

Category tag group TCP Client Traffic removed

Situation

HTTP_CS-Cisco-Prime-Infrastructure-TarArchive-Directory-Traversal

Description has changed

Attacker: connection_source->none

Victim: connection_destination->none

Category tag situation Obsolete added

Category tag os Any Operating System removed

Category tag hardware Any Hardware removed

Category tag application Cisco Systems Prime Infrastructure removed

Category tag group CVE2019 removed

Category tag os_not_specific Any Operating System not specific removed

Category tag situation Suspected Compromise removed

Category tag group HTTP Correlation Dependency Group removed

Category tag group TCP Correlation Dependency Group removed

Category tag group Severity over 4 Correlation Dependency Group removed

Category tag group TCP Client Traffic removed

Situation

HTTP_CSU-Shared-Variables

Situation

HTTP_CSH-Shared-Variables

Fingerprint regexp changed

Situation

HTTP_CRL-Shared-Variables

Situation

Generic_Novell-Groupwise-Messenger-HTTP-POST-Request-Invalid-Memory-Access

Description has changed

Situation

Generic_Novell-Groupwise-Messenger-HTTP-POST-Request-Memory-Access-Violation

Description has changed

Situation

Generic_CS-Shared-Variable-Fingerprints

Fingerprint regexp changed

Situation

File-Text_Suspicious-HTML-File

Application

TOR

Application

DNS-Over-HTTPS

Application

NordVPN

HOW TO IMPORT AND ACTIVATE THE DYNAMIC UPDATE PACKAGE

Download the dynamic update package, then make sure that the checksums for the original files and the files that you have downloaded match.
In the Management Client, select Menu > File > Import > Import Update Packages.
Browse to the file, select it, then click Import.
Select Configuration, then browse to Administration > Other Elements > Updates.
Right-click the imported dynamic update package, then select Activate.
When the activation is finished, refresh the policy on all NGFW Engines. If your policy uses a custom template, you might need to edit the policy.

DISCLAIMER AND COPYRIGHT

Copyright © 2023 Forcepoint
Forcepoint and the FORCEPOINT logo are trademarks of Forcepoint.

All other trademarks used in this document are the property of their respective owners.

Every effort has been made to ensure the accuracy of this document. However, Forcepoint makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Forcepoint shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice.