Release notes for update package 1650-5242

This update package improves the detection capabilities of the Forcepoint NGFW system.

RELEASE DATE:	Monday November 13, 2023
MD5 CHECKSUM:	c889bd5242525bfea2886f71820f37b6
SHA1 CHECKSUM:	cc46af61115d717200061a151c32fb837088d264
SHA256 CHECKSUM:	22f9f9a1960f1cda6640c91a9157d49653e3839261e56a85fee061e49595739a

UPDATE CRITICALITY: HIGH

MINIMUM SOFTWARE VERSIONS

- Forcepoint NGFW Security Management Center:	6.5.1.10631
- Forcepoint NGFW:	6.5.1.21108

List of detected attacks in this update package:

Risk level	Description	Reference	Vulnerability
High	A DNS query containing base64-encoded data detected	No CVE/CAN	DNS-Query-Containing-Base64-Encoded-Data
High	An attempt to exploit a vulnerability in LG Simple Editor detected	CVE-2023-40498	LG-Simple-Editor-Remote-Code-Execution
High	An attempt to exploit a vulnerability in XWiki.org Change Request extension detected	CVE-2023-45138	Xwiki.org-Change-Request-Extension-Code-Injection
High	An attempt to exploit a vulnerability in Korenix JetWave detected	CVE-2023-23294	Korenix-Jetwave-Command-Injection-CVE-2023-23294
High	An attempt to exploit a vulnerability in Stagil Navigation for Jira detected	CVE-2023-26255	Stagil-Navigation-For-JIRA-Path-Traversal-Vulnerabilities
High	An attempt to exploit a vulnerability in Synology SafeAccess detected	CVE-2020-27660	Synology-Safeaccess-SQL-Injection
High	An attempt to exploit a vulnerability in Siretta QUARTZ-GOLD detected	CVE-2022-40969	Siretta-Quartz-Gold-Router-OS-Command-Injection
High	An attempt to exploit a vulnerability in Siretta QUARTZ-GOLD detected	CVE-2022-38459	Siretta-Quartz-Gold-Router-Stack-Buffer-Overflow
High	An attempt to exploit a vulnerability in Canonical ksmdb-tools detected	No CVE/CAN	Canonical-Ksmbd-Tools-Ksmbd.Mountd-SMB_Read_Sid-Heap-Buffer-Overflow
High	An attempt to exploit a vulnerability in F5 Networks BIG-IP detected	CVE-2023-46747	F5-Request-Smuggling-CVE-2023-46747
High	An attempt to exploit a vulnerability in VISAM VBASE Automation Base detected	CVE-2022-45876	Visam-Vbase-Automation-Base-Projektinfo-File-Parsing-External-Entity-Injection

Jump to: Detected Attacks Other Changes

DETECTED ATTACKS

New detected attacks:

HTTP Client Stream

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	LG-Simple-Editor-Remote-Code-Execution	CVE-2023-40498	HTTP_CS-LG-Simple-Editor-Remote-Code-Execution	Suspected Compromise

DNS UDP Client Message

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	DNS-Query-Containing-Base64-Encoded-Data	No CVE/CAN	DNS-UDP_DNS-Query-Containing-Base64-Encoded-Data	Potential Compromise

HTTP Request Header Line

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	F5-Request-Smuggling-CVE-2023-46747	CVE-2023-46747	HTTP_CSH-F5-Request-Smuggling-CVE-2023-46747	Suspected Compromise

MSRPC Client Payload Stream

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Canonical-Ksmbd-Tools-Ksmbd.Mountd-SMB_Read_Sid-Heap-Buffer-Overflow	No CVE/CAN	MSRPC-TCP_CPS--Canonical-Ksmbd-Tools-Ksmbd.Mountd-SMB_Read_Sid-Heap-Buffer-Overflow	Suspected Compromise

HTTP Normalized Request-Line

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Xwiki.org-Change-Request-Extension-Code-Injection	CVE-2023-45138	HTTP_CRL-Xwiki.org-Change-Request-Extension-Code-Injection	Suspected Compromise
High	Korenix-Jetwave-Command-Injection-CVE-2023-23294	CVE-2023-23294	HTTP_CRL-Korenix-Jetwave-Command-Injection-CVE-2023-23294	Suspected Compromise
High	Stagil-Navigation-For-JIRA-Path-Traversal-Vulnerabilities	CVE-2023-26255	HTTP_CRL-Stagil-Navigation-For-JIRA-Path-Traversal-Vulnerabilities	Suspected Compromise
High	Synology-Safeaccess-SQL-Injection	CVE-2020-27660	HTTP_CRL-Synology-Safeaccess-SQL-Injection	Suspected Compromise
High	Siretta-Quartz-Gold-Router-OS-Command-Injection	CVE-2022-40969	HTTP_CRL-Siretta-Quartz-Gold-Router-OS-Command-Injection	Suspected Compromise
High	Siretta-Quartz-Gold-Router-Stack-Buffer-Overflow	CVE-2022-38459	HTTP_CRL-Siretta-Quartz-Gold-Router-Stack-Buffer-Overflow	Suspected Compromise

Identified Text File Stream

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Visam-Vbase-Automation-Base-Projektinfo-File-Parsing-External-Entity-Injection	CVE-2022-45876	File-TextId_Visam-Vbase-Automation-Base-Projektinfo-File-Parsing-External-Entity-Injection	Suspected Compromise

Updated detected attacks:

UDP Packet Unknown

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

W32/Nuwar@mm-Malware

No CVE/CAN

Generic_UDP-W32/Nuwar@mm-Encrypted-Traffic

Botnet

Detection mechanism updated

HTTP Normalized Request-Line

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Realtek-SDK-formSysCmd-Command-Execution-CVE-2021-35395

CVE-2021-35395

HTTP_CRL-Realtek-SDK-formSysCmd-Command-Execution-CVE-2021-35395

Suspected Compromise

Description has changed

SMB Client Header Stream

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Portable-Executable-msstyles-File-Transfer

No CVE/CAN

SMB-TCP_CHS-Microsoft-Windows-Themes-Race-Condition

Suspected Compromise

Name: SMB-TCP_Microsoft-Windows-Themes-Race-Condition->SMB-TCP_CHS-Microsoft-Windows-Themes-Race-Condition

Description has changed

Category tag group MS2023-09 added

Category tag group CVE2023 added

OLE File Stream

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Microsoft-Excel-Memory-Corruption-CVE-2012-1886

CVE-2012-1886

File-OLE_Microsoft-Excel-Memory-Corruption-CVE-2012-1886

Potential Compromise

Detection mechanism updated

High

Oracle-Outside-In-Excel-Propertysetstream-Out-Of-Bounds-Write

CVE-2018-3010

File-OLE_Oracle-Outside-In-Excel-Propertysetstream-Out-Of-Bounds-Write

Potential Compromise

Detection mechanism updated

High

Delta-Industrial-Automation-DOPSoft-XLS-Index-Record-Parsing-Buffer-Overflow

CVE-2021-38406

File-OLE_Delta-Industrial-Automation-DOPSoft-XLS-Index-Record-Parsing-Buffer-Overflow

Potential Compromise

Detection mechanism updated

Identified Text File Stream

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Shellcode-Encoder

No CVE/CAN

File-TextId_x86-X41nop-Shellcode

Potential Compromise

Fingerprint regexp changed

High

Visam-Vbase-Automation-Base-Webremote-File-Parsing-External-Entity-Injection

CVE-2022-46286

File-TextId_Visam-Vbase-Automation-Base-Webremote-File-Parsing-External-Entity-Injection

Suspected Compromise

Fingerprint regexp changed

LIST OF OTHER CHANGES:

New objects:

Type	Name
Category	Canonical ksmdb-tools
Category	Korenix JetWave
Category	Stagil Navigation for Jira
Category	Siretta QUARTZ-GOLD
Certificate Authority	Amazon RSA 2048 M03
Certificate Authority	Amazon ECDSA 256 M03
Certificate Authority	ANTIC DV CA
Certificate Authority	cyber_Folks
Certificate Authority	Yekta Domain Validated SSL CA 1
Certificate Authority	UCA Global G2 Root (2)
Certificate Authority	D-TRUST SSL CA 2 2020
Certificate Authority	TU Dresden CA
Certificate Authority	DigiCert G2 TLS EU RSA4096 SHA384 2022 CA1
Certificate Authority	GeoTrust G2 TLS CN RSA4096 SHA256 2022 CA1
Certificate Authority	Verokey Verified Business G2
Certificate Authority	Aetna Inc. Secure EV CA
Certificate Authority	GeoTrust EV CN RSA G1
Certificate Authority	Secure Site Pro Extended Validation CA
Certificate Authority	DigiCert G5 TLS RSA4096 SHA384 2021 CA1
Certificate Authority	Thawte G5 TLS RSA4096 SHA384 2022 CA1
Certificate Authority	Namirial OV SSL CA 2023
Certificate Authority	Alibaba Cloud GCC R3 AlphaSSL CA 2023
Certificate Authority	GlobalSign Atlas R3 AlphaSSL CA 2023 Q2
Certificate Authority	GlobalSign Atlas R3 DV TLS CA 2023 Q2
Certificate Authority	GlobalSign Atlas R3 DV TLS CA 2023 Q3
Certificate Authority	GlobalSign Atlas R3 OV TLS CA 2023 Q2
Certificate Authority	GlobalSign Atlas R3 OV TLS CA 2023 Q3
Certificate Authority	GlobalSign CloudSSL CA - SHA256 - G3
Certificate Authority	GlobalSign (1)
Certificate Authority	Go Daddy Root Certificate Authority - G2 (1)
Certificate Authority	HARICA Institutional TLS RSA 2
Certificate Authority	NETLOCK Trust EV CA 3
Certificate Authority	GEANT EV ECC CA 4
Certificate Authority	InCommon ECC Server CA 2
Certificate Authority	Trusted Secure ECC Certificate Authority
Certificate Authority	CATrust RSA OV SSL CA
Certificate Authority	Corporation Service Company RSA OV SSL CA
Certificate Authority	EUNETIC RSA Domain Validation Secure Server CA 3
Certificate Authority	GoGetSSL RSA EV CA
Certificate Authority	SecureCore RSA EV CA
Certificate Authority	ZwTrus OV SSL CA
Certificate Authority	SwissSign RSA TLS DV ICA 2022 - 1
Certificate Authority	SwissSign RSA TLS OV ICA 2022 - 1
Certificate Authority	Amazon ECDSA 384 M03
Certificate Authority	TeleSec Business CA 1
Certificate Authority	DigiCert Secure Site ECC CA-1
Certificate Authority	GeoTrust Global G2 TLS EUR RSA4096 SHA384 2023 CA1
Certificate Authority	Microsoft Azure RSA TLS Issuing CA 03
Certificate Authority	Microsoft Azure RSA TLS Issuing CA 04
Certificate Authority	Microsoft Azure RSA TLS Issuing CA 07
Certificate Authority	Microsoft Azure RSA TLS Issuing CA 08
Certificate Authority	DigiCert TLS ECC P384 Root G5 (1)
Certificate Authority	Microsoft Azure ECC TLS Issuing CA 05
Certificate Authority	GeoTrust G5 TLS ECC P-384 SHA384 2022 CA2
Certificate Authority	Entrust Root Certification Authority - EC1 (1)
Certificate Authority	GlobalSign Atlas R3 AlphaSSL CA 2023 Q3
Certificate Authority	GlobalSign Atlas R3 AlphaSSL CA 2023 Q4
Certificate Authority	GlobalSign Atlas R3 DV TLS CA 2023 Q4
Certificate Authority	GlobalSign Atlas R3 OV TLS CA 2023 Q4
Certificate Authority	GlobalSign GCC R6 AlphaSSL CA 2023
Certificate Authority	e-Szigno Class3 SSL CA 2017
Certificate Authority	SECOM Passport for Web EV 2.0 CA (1)
Certificate Authority	TrustAsia ECC DV TLS CA G3
Certificate Authority	E-SAFER ORGANIZATION SSL CA
Certificate Authority	EUNETIC RSA Organization Validation Secure Server CA 3
Certificate Authority	Gandi RSA Domain Validation Secure Server CA 3
Certificate Authority	Gandi RSA Organization Validation Secure Server CA 3
Certificate Authority	GENIOUS RSA Domain Validation Secure Server CA
Certificate Authority	InCommon RSA IGTF Server CA 3
Certificate Authority	Network Solutions RSA DV SSL CA 3
Certificate Authority	Network Solutions RSA OV SSL CA 3
Certificate Authority	Valid Certificadora RSA OV SSL CA
Certificate Authority	Xinnet DV SSL
Certificate Authority	TWCA Secure SSL Certification Authority (1)
Certificate Authority	TWCA Secure SSL Certification Authority (2)
Certificate Authority	Viking Cloud Organization Validation CA, Level 1
IPList	Google Cloud IP Address List for us-west8

Updated objects:

Type

Name

Changes

Certificate Authority

WoTrus DV Server CA

Situation

URL_List-DNS-Over-HTTPS

Detection mechanism updated

IPList

Saudi Arabia

IPList

Iran

IPList

Cyprus

IPList

Tanzania

IPList

Syria

IPList

Armenia

IPList

Kenya

IPList

DR Congo

IPList

Seychelles

IPList

Qatar

IPList

Bahrain

IPList

United Arab Emirates

IPList

Israel

IPList

Turkey

IPList

Ethiopia

IPList

Egypt

IPList

Sudan

IPList

Greece

IPList

Estonia

IPList

Latvia

IPList

Azerbaijan

IPList

Lithuania

IPList

Svalbard and Jan Mayen

IPList

Georgia

IPList

Moldova

IPList

Belarus

IPList

Finland

IPList

Åland Islands

IPList

Ukraine

IPList

Hungary

IPList

Bulgaria

IPList

Poland

IPList

Romania

IPList

Kosovo

IPList

Mauritius

IPList

South Africa

IPList

Madagascar

IPList

Afghanistan

IPList

Pakistan

IPList

Bangladesh

IPList

Sri Lanka

IPList

Bhutan

IPList

India

IPList

Maldives

IPList

Myanmar

IPList

Uzbekistan

IPList

Kazakhstan

IPList

Kyrgyzstan

IPList

Palau

IPList

Vietnam

IPList

Thailand

IPList

Indonesia

IPList

Taiwan

IPList

Philippines

IPList

Malaysia

IPList

China

IPList

Hong Kong

IPList

Macao

IPList

Cambodia

IPList

South Korea

IPList

Japan

IPList

North Korea

IPList

Singapore

IPList

Cook Islands

IPList

Timor-Leste

IPList

Russia

IPList

Australia

IPList

New Zealand

IPList

Libya

IPList

Cameroon

IPList

Senegal

IPList

Portugal

IPList

Ivory Coast

IPList

Nigeria

IPList

Burkina Faso

IPList

Guinea-Bissau

IPList

Gibraltar

IPList

Guinea

IPList

Tunisia

IPList

Spain

IPList

Morocco

IPList

Malta

IPList

Denmark

IPList

Iceland

IPList

United Kingdom

IPList

Switzerland

IPList

Sweden

IPList

The Netherlands

IPList

Austria

IPList

Belgium

IPList

Germany

IPList

Luxembourg

IPList

Ireland

IPList

France

IPList

Andorra

IPList

Liechtenstein

IPList

Slovakia

IPList

Czechia

IPList

Norway

IPList

Vatican City

IPList

San Marino

IPList

Italy

IPList

Slovenia

IPList

Montenegro

IPList

Croatia

IPList

Bosnia and Herzegovina

IPList

Angola

IPList

Paraguay

IPList

Uruguay

IPList

Brazil

IPList

Jamaica

IPList

Dominican Republic

IPList

Cuba

IPList

Bahamas

IPList

Trinidad and Tobago

IPList

Aruba

IPList

Belize

IPList

Guatemala

IPList

Honduras

IPList

Costa Rica

IPList

Venezuela

IPList

Ecuador

IPList

Colombia

IPList

Panama

IPList

Argentina

IPList

Chile

IPList

Bolivia

IPList

Peru

IPList

Mexico

IPList

French Polynesia

IPList

Kiribati

IPList

Tokelau

IPList

Wallis and Futuna

IPList

Northern Mariana Islands

IPList

Guam

IPList

American Samoa

IPList

Canada

IPList

United States

IPList

Palestine

IPList

Serbia

IPList

Curaçao

IPList

TOR exit nodes IP Address List

IPList

Amazon AMAZON

IPList

Amazon EC2

IPList

Akamai Servers

IPList

TOR relay nodes IP Address List

IPList

Amazon AMAZON ap-southeast-1

IPList

NordVPN Servers IP Address List

IPList

Amazon AMAZON us-east-1

IPList

Amazon EC2 us-east-1

Situation

HTTP_CSU-Shared-Variables

Situation

HTTP_CSH-Shared-Variables

Fingerprint regexp changed

Situation

File-PDF_Adobe-Reader-Heap-Overflow-Vulnerability-CVE-2013-0621

Description has changed

Category tag situation Obsolete added

Category tag os Any Operating System removed

Category tag hardware Any Hardware removed

Category tag application Adobe Reader removed

Category tag group CVE2013 removed

Category tag os_not_specific Any Operating System not specific removed

Category tag situation Potential Compromise removed

Category tag group Severity over 4 Correlation Dependency Group removed

Situation

File-TextId_Shared-Variables

Fingerprint regexp changed

Situation

File-Name_Shared-Variables

Application

Hulu

Application Port "tcp/443 tls: mandatory" added

TLS Match identification changed from to true

Application

Google-Play

Application Port "tcp/443 tls: free" -> "tcp/443 tls: mandatory"

TLS Match identification changed from false to true

Application

Akamai-Infrastructure

Application

TOR

Application

Manoto

Application

DNS-Over-HTTPS

Application

Generic-TLS-1.3

Application detection context content changed

Application

Generic-TLS-1.2

Application detection context content changed

Application

Generic-TLS-1.1

Application detection context content changed

Application

Generic-TLS-1.0

Application detection context content changed

Application

NordVPN

HOW TO IMPORT AND ACTIVATE THE DYNAMIC UPDATE PACKAGE

Download the dynamic update package, then make sure that the checksums for the original files and the files that you have downloaded match.
In the Management Client, select Menu > File > Import > Import Update Packages.
Browse to the file, select it, then click Import.
Select Configuration, then browse to Administration > Other Elements > Updates.
Right-click the imported dynamic update package, then select Activate.
When the activation is finished, refresh the policy on all NGFW Engines. If your policy uses a custom template, you might need to edit the policy.

DISCLAIMER AND COPYRIGHT

Copyright © 2023 Forcepoint
Forcepoint and the FORCEPOINT logo are trademarks of Forcepoint.

All other trademarks used in this document are the property of their respective owners.

Every effort has been made to ensure the accuracy of this document. However, Forcepoint makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Forcepoint shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice.