Release notes for update package 1705-5242

This update package improves the detection capabilities of the Forcepoint NGFW system.

RELEASE DATE:    Tuesday March 19, 2024
MD5 CHECKSUM:    56763e5ede19ade6248d3c55233f182e
SHA1 CHECKSUM:    39a598bceba17effb4f3152df03798dfbf639ca3
SHA256 CHECKSUM:    7d840c4f5f5e5e9540bbf9293cde2c3ac9bb927b84cd43fcc6b1c3aec0a5336c

UPDATE CRITICALITY:    HIGH

MINIMUM SOFTWARE VERSIONS
- Forcepoint NGFW Security Management Center:    6.10.1.11125
- Forcepoint NGFW:    6.8.1.24103

List of detected attacks in this update package:

Risk levelDescriptionReferenceVulnerability
High     An attempt to exploit a vulnerability in aiohttp detected     CVE-2024-23334     Aiohttp-Directory-Traversal-CVE-2024-23334
High     An attempt to exploit a vulnerability in LG LED Assistant detected     No CVE/CAN LG-LED-Assistant-Setthumbnailrc-Directory-Traversal
High     A potential TLS Heartbeat response detected     CVE-2014-0160     OpenSSL-TLS-Heartbeat-Vulnerability
High     An attempt to exploit a vulnerability in Perl Spreadsheet::ParseExcel detected     CVE-2023-7101     Perl-Spreadsheet-Parseexcel-Code-Injection-CVE-2023-7101
High     An attempt to exploit a vulnerability in Perl Spreadsheet::ParseExcel detected     CVE-2023-7101     Perl-Spreadsheet-Parseexcel-Code-Injection-CVE-2023-7101

Jump to: Detected Attacks Other Changes

DETECTED ATTACKS

New detected attacks:

HTTPS Server Stream

RiskVulnerability/SituationReferencesRelated FingerprintSituation Type
High OpenSSL-TLS-Heartbeat-Vulnerability CVE-2014-0160 HTTPS_SS-TLS-Potential-Heartbeat-Response Potential Compromise

HTTP Request URI

RiskVulnerability/SituationReferencesRelated FingerprintSituation Type
High Aiohttp-Directory-Traversal-CVE-2024-23334 CVE-2024-23334 HTTP_CSU-Aiohttp-Directory-Traversal-CVE-2024-23334 Suspected Compromise

HTTP Normalized Request-Line

RiskVulnerability/SituationReferencesRelated FingerprintSituation Type
High LG-LED-Assistant-Setthumbnailrc-Directory-Traversal No CVE/CAN HTTP_CRL-LG-LED-Assistant-Setthumbnailrc-Directory-Traversal Suspected Compromise

OLE File Stream

RiskVulnerability/SituationReferencesRelated FingerprintSituation Type
High Perl-Spreadsheet-Parseexcel-Code-Injection-CVE-2023-7101 CVE-2023-7101 File-OLE_Perl-Spreadsheet-Parseexcel-Code-Injection-CVE-2023-7101 Potential Compromise

Identified Text File Stream

RiskVulnerability/SituationReferencesRelated FingerprintSituation Type
High Perl-Spreadsheet-Parseexcel-Code-Injection-CVE-2023-7101 CVE-2023-7101 File-TextId_Perl-Spreadsheet-Parseexcel-Code-Injection-CVE-2023-7101 Potential Compromise

Updated detected attacks:

HTTPS Server Stream

RiskVulnerability/SituationReferencesRelated FingerprintSituation TypeChange Description
High OpenSSL-TLS-Heartbeat-Vulnerability CVE-2014-0160 HTTPS_SS-TLS-Heartbeat-Response Suspected Compromise
Fingerprint regexp changed

HTTP Normalized Request-Line

RiskVulnerability/SituationReferencesRelated FingerprintSituation TypeChange Description
High JetBrains-TeamCity-Authentication-Bypass-CVE-2024-27198 CVE-2024-27198 HTTP_CRL-JetBrains-TeamCity-Authentication-Bypass-CVE-2024-27198 Suspected Compromise
Fingerprint regexp changed

Text File Stream

RiskVulnerability/SituationReferencesRelated FingerprintSituation TypeChange Description
High Malicious-Internet-Shortcut-File No CVE/CAN File-Text_Malicious-Internet-Shortcut-File Spyware, Malware and Adware
Fingerprint regexp changed

OLE File Stream

RiskVulnerability/SituationReferencesRelated FingerprintSituation TypeChange Description
High Barracuda-ESG-Parameter-Injection-CVE-2023-7102 CVE-2023-7102 File-OLE_Barracuda-ESG-Parameter-Injection-CVE-2023-7102 Suspected Compromise
Detection mechanism updated

LIST OF OTHER CHANGES:

New objects:

TypeName
Categoryaiohttp
ApplicationShieldSquare
SituationURLList 3211312

Updated objects:

TypeNameChanges
SituationURL_List-DNS-Over-HTTPS
Detection mechanism updated
IPListTOR exit nodes IP Address List
IPListAmazon AMAZON
IPListFacebook Servers
IPListAkamai Servers
IPListTOR relay nodes IP Address List
IPListZscaler IP Address List
IPListSalesforce Community Cloud
IPListOkta IP Address List
IPListBotnet IP Address List
IPListMalicious Site IP Address List
IPListNordVPN Servers IP Address List
IPListAmazon AMAZON ap-southeast-2
IPListAmazon AMAZON ap-southeast-5
IPListAmazon AMAZON eu-west-1
IPListAmazon AMAZON eu-west-3
IPListForcepoint Drop IP Address List
IPListForcepoint Extended Drop IP Address List
SituationHTTP_CRL-Suspicious-Parameter-Value
Fingerprint regexp changed
SituationHTTP_PSU-Shared-Variables
Fingerprint regexp changed
SituationFile-Name_Shared-Variables
ApplicationFacebook
ApplicationAkamai-Infrastructure
ApplicationTOR
ApplicationManoto
ApplicationDNS-Over-HTTPS
ApplicationNordVPN

HOW TO IMPORT AND ACTIVATE THE DYNAMIC UPDATE PACKAGE

  1. Download the dynamic update package, then make sure that the checksums for the original files and the files that you have downloaded match.
  2. In the Management Client, select Menu > File > Import > Import Update Packages.
  3. Browse to the file, select it, then click Import.
  4. Select  Configuration, then browse to Administration > Other Elements > Updates.
  5. Right-click the imported dynamic update package, then select Activate.
  6. When the activation is finished, refresh the policy on all NGFW Engines. If your policy uses a custom template, you might need to edit the policy.

DISCLAIMER AND COPYRIGHT

Copyright © 2024 Forcepoint
Forcepoint and the FORCEPOINT logo are trademarks of Forcepoint.

All other trademarks used in this document are the property of their respective owners.

Every effort has been made to ensure the accuracy of this document. However, Forcepoint makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Forcepoint shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice.