Release notes for update package 1833-5242

This update package improves the detection capabilities of the Forcepoint NGFW system.

RELEASE DATE:    Friday February 07, 2025
MD5 CHECKSUM:    628fcfae6bd81d20e48116af891d4163
SHA1 CHECKSUM:    77c940c37dd7d056c783854d7b892a779649fb65
SHA256 CHECKSUM:    67c387ec669741018a5db138125e00552cb642b25e712a2def99c02b3a948a6f


UPDATE CRITICALITY:    HIGH

MINIMUM SOFTWARE VERSIONS
- Forcepoint NGFW Security Management Center:    6.10.1.11125
- Forcepoint NGFW:    6.8.1.24103

List of detected attacks in this update package:

Risk levelDescriptionReferenceVulnerability
High     An attempt to exploit a vulnerability in Microsoft .NET Framework detected     CVE-2024-29059     Microsoft-.NET-Framework-Information-Disclosure-CVE-2024-29059
High     An attempt to exploit a vulnerability in SAP Internet Communication Manager detected     CVE-2022-22536     SAP-Internet-Communication-Manager-HTTP-Request-Smuggling

Jump to: Detected Attacks Other Changes

DETECTED ATTACKS

New detected attacks:

HTTP Request Header Line

RiskVulnerability/SituationReferencesRelated FingerprintSituation Type
High SAP-Internet-Communication-Manager-HTTP-Request-Smuggling CVE-2022-22536 HTTP_CSH-SAP-Internet-Communication-Manager-HTTP-Request-Smuggling Suspected Compromise
High Microsoft-.NET-Framework-Information-Disclosure-CVE-2024-29059 CVE-2024-29059 HTTP_CSH-Microsoft-.NET-Framework-Information-Disclosure-CVE-2024-29059 Suspected Compromise

Updated detected attacks:

HTTP Client Stream

RiskVulnerability/SituationReferencesRelated FingerprintSituation TypeChange Description
High SAP-Internet-Communication-Manager-HTTP-Request-Smuggling CVE-2022-22536 HTTP_CS-SAP-Internet-Communication-Manager-HTTP-Request-Smuggling Suspected Compromise
Fingerprint regexp changed

HTTP Request URI

RiskVulnerability/SituationReferencesRelated FingerprintSituation TypeChange Description
High Suspicious-Windows-Script-Retrieval-Via-WebDav No CVE/CAN HTTP_CSU-Suspicious-Windows-Script-File-Retrieval-Via-WebDav Suspected Compromise
Fingerprint regexp changed

Text File Stream

RiskVulnerability/SituationReferencesRelated FingerprintSituation TypeChange Description
Low HTML-Tag-Detector No CVE/CAN File-Text_HTML-Tag-Detector System Inspections
Description has changed
Fingerprint regexp changed
High ADODB.Stream-ActiveX-Object-Local-Disk-Write No CVE/CAN File-Text_ADODB.Stream-ActiveX-Object-Local-Disk-Write Potential Compromise
Fingerprint regexp changed

LIST OF OTHER CHANGES:

Updated objects:

TypeNameChanges
IPListTOR exit nodes IP Address List
IPListAmazon AMAZON
IPListAmazon EC2
IPListMicrosoft Azure datacenter for australiaeast
IPListTOR relay nodes IP Address List
IPListMicrosoft Azure datacenter for centralindia
IPListMicrosoft Azure datacenter for centralus
IPListMicrosoft Azure datacenter for eastus2euap
IPListMicrosoft Azure datacenter for eastus2
IPListMicrosoft Azure datacenter for eastus
IPListMicrosoft Azure datacenter for centralfrance
IPListMicrosoft Azure datacenter for japaneast
IPListMicrosoft Azure datacenter for northcentralus
IPListMicrosoft Azure datacenter for northeurope
IPListMicrosoft Azure datacenter for southcentralus
IPListMicrosoft Azure datacenter for westeurope
IPListMicrosoft Azure datacenter for westus
IPListMicrosoft Azure datacenter
IPListMalicious Site IP Address List
IPListMicrosoft Azure datacenter for malaysiasouth
IPListMicrosoft Azure service for Dynamics365BusinessCentral
IPListMicrosoft Azure service for Marketplace
IPListNordVPN Servers IP Address List
IPListForcepoint Drop IP Address List
IPListAmazon AMAZON us-west-2
IPListAmazon EC2 us-west-2
IPListMicrosoft Azure datacenter for switzerlandn
IPListMicrosoft Azure service for AzureCloud
IPListMicrosoft Azure service for AzureMonitor
IPListMicrosoft Azure service for AzureResourceManager
IPListMicrosoft Azure service for PowerBI
IPListMicrosoft Azure datacenter for usstagee
IPListMicrosoft Azure datacenter for westus3
IPListMicrosoft Azure service for AzureSecurityCenter
IPListMicrosoft Azure datacenter for mexicocentral
IPListMicrosoft Azure datacenter for newzealandnorth
IPListMicrosoft Azure datacenter for polandcentral
IPListMicrosoft Azure datacenter for spaincentral
SituationHTTP_CSU-Shared-Variables
SituationHTTP_CSH-Shared-Variables
SituationHTTP_PSU-Shared-Variables
Fingerprint regexp changed
ApplicationTOR
ApplicationNordVPN

HOW TO IMPORT AND ACTIVATE THE DYNAMIC UPDATE PACKAGE

  1. Download the dynamic update package, then make sure that the checksums for the original files and the files that you have downloaded match.
  2. In the Management Client, select Menu > File > Import > Import Update Packages.
  3. Browse to the file, select it, then click Import.
  4. Select  Configuration, then browse to Administration > Other Elements > Updates.
  5. Right-click the imported dynamic update package, then select Activate.
  6. When the activation is finished, refresh the policy on all NGFW Engines. If your policy uses a custom template, you might need to edit the policy.

DISCLAIMER AND COPYRIGHT

Copyright © 2025 Forcepoint
Forcepoint and the FORCEPOINT logo are trademarks of Forcepoint.

All other trademarks used in this document are the property of their respective owners.

Every effort has been made to ensure the accuracy of this document. However, Forcepoint makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Forcepoint shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice.