Summary
Digital Vaccine #9038 November 21, 2017
Details
| Thank you for subscribing to Digital Vaccine updates brought to you by Trend Micro™ TippingPoint DVLabs. New content is now available at the Threat Management Center (TMC): https://tmc.tippingpoint.com SMS customers can update the Digital Vaccine through the SMS client. From the top line menu, you can open the "File > Download Digital Vaccine from TMC" menu item to detect and load the latest update. |
| System Requirements |
| The 3.2.0 DV will run on IPS devices with TOS v3.2.0 and above, all NGFW and all TPS systems. The 4.0.0 DV will only run on the Virtual Threat Protection System (vTPS) appliance. Please note that vTPS does not currently support pre-disclosed ZDI filters. |
| Deployment of 3.2.0 DV |
| Customers with 10/110/330 systems that are running the 3.2.0 DV may see critical /usr partition usage errors in the system log. This is a benign, temporary message and the partition usage is immediately remedied as indicated by log messages following the error. |
| Adobe Security Bulletins This DV includes coverage for the Adobe vulnerabilities released on or before November 14, 2017. The following table maps TippingPoint filters to the Adobe CVEs. | |||
| Bulletin # | CVE # | TippingPoint Filter # | Status |
| APSB17-36 | CVE-2017-16360 | 29994 | |
| APSB17-36 | CVE-2017-16361 | 29999 | |
| APSB17-36 | CVE-2017-16362 | 30030 | |
| APSB17-36 | CVE-2017-16363 | 30023 | |
| APSB17-36 | CVE-2017-16364 | 30006 | |
| APSB17-36 | CVE-2017-16365 | 30027 | |
| APSB17-36 | CVE-2017-16366 | 30019 | |
| APSB17-36 | CVE-2017-16367 | 30014 | |
| APSB17-36 | CVE-2017-16368 | 30015 | |
| APSB17-36 | CVE-2017-16369 | *28924 | |
| APSB17-36 | CVE-2017-16370 | 29996 | |
| APSB17-36 | CVE-2017-16371 | 30001 | |
| APSB17-36 | CVE-2017-16372 | 30004 | |
| APSB17-36 | CVE-2017-16373 | 30039 | |
| APSB17-36 | CVE-2017-16374 | 30044 | |
| APSB17-36 | CVE-2017-16375 | 30043 | |
| APSB17-36 | CVE-2017-16376 | Vendor Deemed Reproducibility or Exploitation Unlikely | |
| APSB17-36 | CVE-2017-16377 | Vendor Deemed Reproducibility or Exploitation Unlikely | |
| APSB17-36 | CVE-2017-16378 | Vendor Deemed Reproducibility or Exploitation Unlikely | |
| APSB17-36 | CVE-2017-16379 | Vendor Deemed Reproducibility or Exploitation Unlikely | |
| APSB17-36 | CVE-2017-16380 | Vendor Deemed Reproducibility or Exploitation Unlikely | |
| APSB17-36 | CVE-2017-16381 | *29639 | |
| APSB17-36 | CVE-2017-16382 | *29638 | |
| APSB17-36 | CVE-2017-16383 | *29637 | |
| APSB17-36 | CVE-2017-16384 | *29636 | |
| APSB17-36 | CVE-2017-16385 | *29635 | |
| APSB17-36 | CVE-2017-16386 | *29584 | |
| APSB17-36 | CVE-2017-16387 | *29484 | |
| APSB17-36 | CVE-2017-16388 | 30040 | |
| APSB17-36 | CVE-2017-16389 | 30041 | |
| APSB17-36 | CVE-2017-16390 | 29998 | |
| APSB17-36 | CVE-2017-16391 | 30003 | |
| APSB17-36 | CVE-2017-16392 | 30002 | |
| APSB17-36 | CVE-2017-16393 | 30005 | |
| APSB17-36 | CVE-2017-16394 | 30035 | |
| APSB17-36 | CVE-2017-16395 | 30037 | |
| APSB17-36 | CVE-2017-16396 | 30032 | |
| APSB17-36 | CVE-2017-16397 | 30000 | |
| APSB17-36 | CVE-2017-16398 | 29995 | |
| APSB17-36 | CVE-2017-16399 | 29997 | |
| APSB17-36 | CVE-2017-16400 | *29852 | |
| APSB17-36 | CVE-2017-16401 | *29851 | |
| APSB17-36 | CVE-2017-16402 | *29853 | |
| APSB17-36 | CVE-2017-16403 | *29833 | |
| APSB17-36 | CVE-2017-16404 | *29850 | |
| APSB17-36 | CVE-2017-16405 | 30038 | |
| APSB17-36 | CVE-2017-16406 | 30042 | |
| APSB17-36 | CVE-2017-16407 | 30045 | |
| APSB17-36 | CVE-2017-16408 | 30034 | |
| APSB17-36 | CVE-2017-16409 | 30036 | |
| APSB17-36 | CVE-2017-16410 | 30024 | |
| APSB17-36 | CVE-2017-16411 | 30021 | |
| APSB17-36 | CVE-2017-16412 | 30020 | |
| APSB17-36 | CVE-2017-16413 | 30018 | |
| APSB17-36 | CVE-2017-16414 | 30016 | |
| APSB17-36 | CVE-2017-16415 | 30025 | |
| APSB17-36 | CVE-2017-16416 | 30007 | |
| APSB17-36 | CVE-2017-16417 | 30013 | |
| APSB17-36 | CVE-2017-16418 | 30017 | |
| APSB17-36 | CVE-2017-16419 | 30022 | |
| APSB17-36 | CVE-2017-16420 | 30026 | |
| APSB17-36 | CVE-2017-11293 | Vendor Deemed Reproducibility or Exploitation Unlikely | |
| APSB17-33 | CVE-2017-3112 | 30008 | |
| APSB17-33 | CVE-2017-3114 | 30009 | |
| APSB17-33 | CVE-2017-11213 | 30010 | |
| APSB17-33 | CVE-2017-11215 | 30011 | |
| APSB17-33 | CVE-2017-11225 | 30012 | |
| Filters marked with * shipped prior to this DV, providing zero-day protection. | |||
| The Digital Vaccine can be manually downloaded from the following URLs: https://tmc.tippingpoint.com/TMC/ViewPackage?parentFolderId=digital_vaccines&contentId=SIG_3.2.0_9038.pkg https://tmc.tippingpoint.com/TMC/ViewPackage?parentFolderId=vsa_dv&contentId=SIG_VTPS_4.0.0_9038.pkg |
Update Details
Table of Contents
--------------------------
Filters
New Filters
Modified Filters (logic changes)
Modified Filters (metadata changes only)
Removed Filters
Filters
----------------
New Filters:
29980: HTTP: WordPress Authenticated Stored Cross-Site Scripting Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Vulnerabilities
- Severity: Critical
- Description: This filter detects an attempt to exploit a cross-site scripting vulnerability in WordPress.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-14726
29994: HTTP: Adobe Acrobat Reader MakeAccessible Plugin Use-After-Free Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: Critical
- Description: This filter detects an attempt to exploit a use-after-free vulnerability in Adobe Acrobat Reader.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Bugtraq ID: 101818
- Common Vulnerabilities and Exposures: CVE-2017-16360
29995: HTTP: Adobe Acrobat Reader JavaScript API Annotation Use-After-Free Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: Critical
- Description: This filter detects an attempt to exploit a use-after-free vulnerability in Adobe Acrobat Reader.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Bugtraq ID: 101818
- Common Vulnerabilities and Exposures: CVE-2017-16398
29996: HTTP: Adobe Acrobat Reader JavaScript Engine execDialog Out-of-Bounds Read Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Vulnerabilities
- Severity: High
- Description: This filter detects an attempt to exploit an out-of-bounds read vulnerability in Adobe Acrobat Reader.
- Deployments:
- Deployment: Security-Optimized (Block / Notify)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-16370
29997: HTTP: Adobe Acrobat XPS Parsing Module Glyph Out-of-Bounds Read Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: Critical
- Description: This filter detects an attempt to exploit an out-of-bounds read vulnerability in Adobe Acrobat.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-16399
29998: HTTP: Adobe Acrobat Reader JavaScript Engine borderStyle Use-After-Free Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: Critical
- Description: This filter detects an attempt to exploit a use-after-free in Adobe Acrobat Reader.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Bugtraq ID: 101818
- Common Vulnerabilities and Exposures: CVE-2017-16390
29999: HTTP: Adobe Reader Forms Data Format Security Bypass Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: Critical
- Description: This filter detects an attempt to exploit a security bypass vulnerability in Adobe Acrobat Reader.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Bugtraq ID: 101830
- Common Vulnerabilities and Exposures: CVE-2017-16361
30000: HTTP: Adobe Acrobat EMF Parsing Out-Of-Bounds Read Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: Critical
- Description: This filter detects an attempt to exploit an out-of-bounds vulnerability in Adobe Acrobat.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-16397
30001: HTTP: Adobe Acrobat Reader JavaScript Engine Memory Corruption Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Vulnerabilities
- Severity: High
- Description: This filter detects an attempt to exploit a memory corruption vulnerability in Adobe Acrobat Reader.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Bugtraq ID: 101813
- Common Vulnerabilities and Exposures: CVE-2017-16371
30002: HTTP: Adobe Acrobat JPEG Comment Memory Corruption Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: Critical
- Description: This filter detects an attempt to exploit a memory corruption vulnerability in Adobe Acrobat.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Bugtraq ID: 101831
- Common Vulnerabilities and Exposures: CVE-2017-16392
30003: HTTP: Adobe Acrobat Reader JavaScript Engine PrintParams Memory Corruption Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Vulnerabilities
- Severity: Critical
- Description: This filter detects an attempt to exploit a memory corruption vulnerability in Adobe Acrobat Reader.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Bugtraq ID: 101819
- Common Vulnerabilities and Exposures: CVE-2017-16391
30004: HTTP: Adobe Acrobat Reader JavaScript Engine thermometer Memory Corruption Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Vulnerabilities
- Severity: High
- Description: This filter detects an attempt to exploit a memory corruption vulnerability in Adobe Acrobat Reader.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Bugtraq ID: 101813
- Common Vulnerabilities and Exposures: CVE-2017-16372
30005: HTTP: Adobe Acrobat Reader JavaScript Engine annots popup Use-After-Free Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Vulnerabilities
- Severity: High
- Description: This filter detects an attempt to exploit a use-after-free in Adobe Acrobat Reader.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Bugtraq ID: 101818
- Common Vulnerabilities and Exposures: CVE-2017-16393
30006: HTTP: Adobe Acrobat Reader Memory Dereferencing Information Disclosure Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: High
- Description: This filter detects an attempt to exploit an information disclosure vulnerability in Adobe Acrobat Reader.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-16364
30007: HTTP: Adobe Acrobat Pro EmfPlusFont EMF Parsing Out-Of-Bounds Write Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: Critical
- Description: This filter detects an attempt to exploit an out-of-bounds write vulnerability in Adobe Acrobat Pro.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-16416
30008: HTTP: Adobe Flash PSDK Information Disclosure Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: High
- Description: This filter detects an attempt to exploit an information disclosure vulnerability in Adobe Flash.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-3112
30009: HTTP: Adobe Flash ID Information Disclosure Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: High
- Description: This filter detects an attempt to exploit an information disclosure vulnerability in Adobe Flash.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-3114
30010: HTTP: Adobe Flash AS2 Bitmap Information Disclosure Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: High
- Description: This filter detects an attempt to exploit an information disclosure vulnerability in Adobe Flash.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-11213
30011: HTTP: Adobe Flash Advertising Metadata Use-After-Free Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: Critical
- Description: This filter detects an attempt to exploit a use-after-free vulnerability in Adobe Flash.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-11215
30012: HTTP: Adobe Flash PSDK Metadata Use-After-Free Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: Critical
- Description: This filter detects an attempt to exploit a use-after-free vulnerability in Adobe Flash.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-11225
30013: HTTP: Adobe Acrobat Reader Embedded TTF Information Disclosure Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: Critical
- Description: This filter detects an attempt to exploit an information disclosure vulnerability in Adobe Acrobat Reader.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-16417
30014: HTTP: Adobe Acrobat Reader Content Stream Buffer Overflow Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: Critical
- Description: This filter detects an attempt to exploit a buffer overflow vulnerability in Adobe Acrobat Reader.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-16367
30015: HTTP: Adobe Acrobat Reader Unicode String Buffer Overflow Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: Critical
- Description: This filter detects an attempt to exploit a buffer overflow vulnerability in Adobe Acrobat Reader.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-16368
30016: HTTP: Adobe Acrobat Reader form Information Disclosure Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: High
- Description: This filter detects an attempt to exploit an information disclosure vulnerability in Adobe Acrobat Reader.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-16414
30017: HTTP: Adobe Acrobat Reader Pro XPS Parsing Module Information Disclosure Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: High
- Description: This filter detects an attempt to exploit an out-of-bounds read vulnerability in Adobe Acrobat Reader Pro.
- Deployments:
- Deployment: Security-Optimized (Block / Notify)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-16418
30018: HTTP: Adobe Acrobat Reader XPS TIFF Parsing Memory Corruption Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: Critical
- Description: This filter detects an attempt to exploit a memory corruption vulnerability in Adobe Acrobat Reader.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-16413
30019: HTTP: Adobe AcroPDF Plugin Information Disclosure Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Vulnerabilities
- Severity: High
- Description: This filter detects an attempt to exploit an information disclosure vulnerability in Adobe AcroPDF plugin.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-16366
30020: HTTP: Adobe Acrobat Reader XPS JPEG Parsing Memory Corruption Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: Critical
- Description: This filter detects an attempt to exploit a memory corruption vulnerability in Adobe Acrobat Reader.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-16412
30021: HTTP: Adobe Acrobat Reader WebCapture Information Disclosure Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: High
- Description: This filter detects an attempt to exploit an information disclosure vulnerability in Adobe Acrobat Reader.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-16411
30022: HTTP: Adobe Acrobat Reader JavaScript API Recursion Memory Corruption Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Vulnerabilities
- Severity: Critical
- Description: This filter detects an attempt to exploit a memory corruption vulnerability in Adobe Acrobat Reader.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-16419
30023: HTTP: Adobe Acrobat Reader Character Codes Module Information Disclosure Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: High
- Description: This filter detects an attempt to exploit a information disclosure vulnerability in Adobe Acrobat Reader.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-16363
30024: HTTP: Adobe Acrobat Reader GIF CommentExtension Memory Corruption Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: Critical
- Description: This filter detects an attempt to exploit a memory corruption vulnerability in Adobe Acrobat Reader.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-16410
30025: HTTP: Adobe Acrobat Reader Font Differences Memory Corruption Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: Critical
- Description: This filter detects an attempt to exploit a memory corruption vulnerability in Adobe Acrobat Reader.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-16415
30026: HTTP: Adobe Acrobat Reader JavaScript Annotation Memory Corruption Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Vulnerabilities
- Severity: Critical
- Description: This filter detects an attempt to exploit a memory corruption vulnerability in Adobe Acrobat Reader.
- Deployments:
- Deployment: Security-Optimized (Block / Notify)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-16420
30027: HTTP: Adobe Acrobat Reader Cmap Table Information Disclosure Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: High
- Description: This filter detects an attempt to exploit an information disclosure vulnerability in Adobe Acrobat Reader.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-16365
30030: HTTP: Adobe Acrobat Reader Font processing Out-of-Bounds Memory Access Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: Critical
- Description: This filter detects an attempt to exploit an out-of-bounds memory access vulnerability in Adobe Acrobat Reader.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-16362
30032: HTTP: Adobe Acrobat TIFF Parse Memory Corruption Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: Critical
- Description: This filter detects an attempt to exploit a memory corruption vulnerability in Adobe Acrobat.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Bugtraq ID: 101831
- Common Vulnerabilities and Exposures: CVE-2017-16396
30034: HTTP: Adobe Acrobat WebCapture Out-Of-Bounds Read Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: Critical
- Description: This filter detects an attempt to exploit an out-of-bounds read vulnerability in Adobe Acrobat.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-16408
30035: HTTP: Adobe Acrobat WebCapture Out-Of-Bounds Read Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: Critical
- Description: This filter detects an attempt to exploit a memory corruption vulnerability in Adobe Acrobat.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-16394
30036: HTTP: Adobe Acrobat EMF Out-Of-Bounds Read Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: Critical
- Description: This filter detects an attempt to exploit an out-of-bounds read vulnerability in Adobe Acrobat.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-16409
30037: HTTP: Adobe Acrobat Reader EMR_STRETCHDIBITS Memory Corruption Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: Critical
- Description: This filter detects an attempt to exploit a memory corruption vulnerability in Adobe Acrobat Reader.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-16395
30038: HTTP: Adobe Acrobat Pro JP2 Record Information Disclosure Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: High
- Description: This filter detects an attempt to exploit an information disclosure vulnerability in Adobe Acrobat Pro.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-16405
30039: HTTP: Adobe Acrobat Reader setPageAction Information Disclosure Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: High
- Description: This filter detects an attempt to exploit an information disclosure vulnerability in Adobe Acrobat Reader.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-16373
30040: HTTP: Adobe Acrobat Reader JavaScript API engine Use-After-Free Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: Critical
- Description: This filter detects an attempt to exploit a use-after-free vulnerability in Adobe Acrobat Reader.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-16388
30041: HTTP: Adobe Acrobat Reader JavaScript API engine Use-After-Free Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: Critical
- Description: This filter detects an attempt to exploit a use-after-free vulnerability in Adobe Acrobat Reader.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-16389
30042: HTTP: Adobe Acrobat Pro EMF file Memory Corruption Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: Critical
- Description: This filter detects an attempt to exploit a memory corruption vulnerability in Adobe Acrobat Pro.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-16406
30043: HTTP: Adobe Acrobat Reader JavaScript API engine Use-After-Free Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: Critical
- Description: This filter detects an attempt to exploit a use-after-free vulnerability in Adobe Acrobat Reader.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-16375
30044: HTTP: Adobe Acrobat Reader JPEG2000 Parsing Information Disclosure Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: High
- Description: This filter detects an attempt to exploit an information disclosure vulnerability in Adobe Acrobat Reader.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-16374
30045: HTTP: Adobe Acrobat Pro EMF file XForm object Memory Corruption Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Category: Exploits
- Severity: Critical
- Description: This filter detects an attempt to exploit a memory corruption vulnerability in Adobe Acrobat Pro.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2017-16407
Modified Filters (logic changes):
* = Enabled in Default deployments
* 3447: FTP: FTP Username Overflow
- IPS Version: 3.2.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
* 5981: ULTRAVOX: AOL Winamp Metadata Parsing Buffer Overflow
- IPS Version: 3.1.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
11055: HTTP: Google Translate Proxy Avoidance
- IPS Version: 3.1.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
11276: HTTP: Cisco Security Agent File Upload Vulnerability (ZDI-11-088)
- IPS Version: 3.1.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
* 11900: Cisco WebEx Player WRF Type 0 Parsing Memory Corruption Vulnerability (ZDI-11-341)
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
12038: ONC-RPC: EMC Networker Stack Overflow (ZDI-12-025)
- IPS Version: 3.2.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
* 12494: HTTP: Novell GroupWise gwcls1.dll ActiveX Control Memory Corruption Vulnerability (ZDI-13-008)
- IPS Version: 3.2.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
* 12683: HTTP: Malicious Rich Text File (RTF) Download
- IPS Version: 3.2.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
12993: HTTP: Nagios Remote Plugin Executor Command Execution Vulnerability
- IPS Version: 3.1.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13217: HTTP: Oracle Data Quality DscXB onloadstatechange Memory Corruption Vulnerability (ZDI-14-108)
- IPS Version: 3.1.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13220: HTTP: Oracle Data Quality FileChooserDlg Memory Corruption Vulnerability (ZDI-14-110)
- IPS Version: 3.1.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13400: HTTP: Microsoft Internet Explorer CPeerFactoryUrlMap Use-After-Free Vulnerability (ZDI-14-175)
- IPS Version: 3.2.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13401: HTTP: Microsoft Internet Explorer CFormElement Use-After-Free Vulnerability (ZDI-14-176)
- IPS Version: 3.1.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13454: HTTP: Microsoft Internet Explorer fireEvent Use-After-Free Vulnerability (ZDI-14-125)
- IPS Version: 3.1.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13528: HTTP: Microsoft Internet Explorer Type Confusion Vulnerability
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13551: HTTP: Borland Silk Central TeeChart ActiveX Control Instantiation (ZDI-14-124)
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13553: HTTP: CA ERwin Web Portal Information Disclosure Vulnerability (ZDI-14-093 / ZDI-14-095)
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13554: HTTP: CA ERwin Web Portal FileAccessServiceProvider Denial-of-Service Vulnerability (ZDI-14-096)
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13555: TCP: CA ERwin Web Portal ProfileIconServlet Information Disclosure Vulnerability (ZDI-14-097)
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13575: HTTP: IBM Tivoli Provisioning Manager Express ActiveX Control Instantiation
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13587: HTTP: Microsoft Internet Explorer CElement Use-After-Free Vulnerability (ZDI-14-181)
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13590: HTTP: Microsoft Internet Explorer Use-After-Free Vulnerability (ZDI-14-182)
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13592: NTP: NTP Monitor List Request Command
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13619: HTTP: PHP X.509 Denial-of-Service Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13625: HTTP: Microsoft Internet Explorer CDOMTextNode Use-After-Free Vulnerability (ZDI-14-186)
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13632: HTTP: Oracle Java Beans XML External Entity (XXE) Usage
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13643: HTTP: PDF Download Containing XFA Form
- IPS Version: 3.2.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13649: HTTP: HP Universal CMDB mam-collectors Information Disclosure Vulnerability (ZDI-14-229)
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13650: HTTP: HP SiteScope Servlet Directory Traversal Vulnerability (ZDI-14-228)
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13651: HTTP: Microsoft Internet Explorer CTreePos Use-After-Free Vulnerability (ZDI-14-184)
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13664: TCP: Download/Upload of a JAR Compressed Java Application
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Description updated.
- Detection logic updated.
- Deployments updated and are now:
- Deployment: Performance-Optimized (Block / Notify)
13737: HTTP: Mozilla Firefox Chrome Security Bypass Vulnerability (ZDI-14-081)
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13739: HTTP: Mozilla Firefox TypeObject Use-After-Free Vulnerability (ZDI-14-083)
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13742: HTTP: Apple Safari Buffer Overflow Vulnerability (ZDI-14-091)
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13743: HTTP: Mozilla Firefox TypedArrayObject Out-Of-Bounds Memory Corruption Vulnerability (ZDI-14-085)
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13744: HTTP: Microsoft Internet Explorer onpropertychange Use-After-Free Vulnerability (ZDI-14-219)
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13745: HTTP: Microsoft Internet Explorer replaceNode Use-After-Free Vulnerability (ZDI-14-192)
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13746: HTTP: Google Chrome Blink Use-After-Free Vulnerability (ZDI-14-086)
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13747: HTTP: Google Chrome V8 Memory Corruption Vulnerability (ZDI-14-088)
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13749: HTTP: Microsoft Internet Explorer CWindow Use-After-Free Vulnerability (ZDI-14-191)
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13794: HTTP: Microsoft Internet Explorer DOMNodeRemoved Use-After-Free Vulnerability (ZDI-14-193)
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13799: LDAP: OpenLDAP Suspicious Query Request (ONLY enable when under DoS attack)
- IPS Version: 3.1.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13800: HTTP: Pastebin User Authentication
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
- NGFW Application Groups updated.
13804: HTTP: Pastebin Create New Paste
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
- NGFW Application Groups updated.
13806: HTTP: Pastebin Access To Trending Pastes, Tools and Archives
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
- NGFW Application Groups updated.
13807: HTTP: Pastebin Access to Public Pastes
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
- NGFW Application Groups updated.
13815: HTTP: Cogent DataHub Command Injection Vulnerability (ZDI-14-136)
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13821: HTTP: PHP dateInterval Denial-of-Service Vulnerability
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13825: HTTP: Microsoft Internet Explorer CImgElement Use-After-Free Vulnerability (ZDI-14-222)
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13827: HTTP: Microsoft Internet Explorer ControlTracker Use-After-Free Vulnerability (ZDI-14-213)
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13832: HTTP: Adobe Flash Cross-Site Scripting Vulnerability
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13834: HTTP: Microsoft Internet Explorer CAttrArray Use-After-Free Vulnerability (ZDI-14-223)
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13837: HTTP: Oracle Data Quality DateTimeWrapper ActiveX Control Instantiation (ZDI-14-107)
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13839: HTTPS: Zimbra Collaboration Server Directory Traversal Vulnerability
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
* 13841: HTTP: PixiPOS Malware Communication Attempt
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13843: HTTP: Oracle Outside-In Maintenance OS/2 Metafile Parser Buffer Overflow Vulnerability
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13844: HTTP: Symantec Web Gateway blacklist.php Cross-Site Scripting Vulnerability
- IPS Version: 3.1.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13850: HTTP: Rocket Servergraph Admin Center tsmRequest Command Injection Vulnerability (ZDI-14-164)
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13851: HTTP: Rocket Servergraph Admin Center userRequest Command Injection Vulnerability (ZDI-14-164)
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13876: TCP: Download/Upload of a Java .class Application
- IPS Version: 3.1.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13912: HTTP: DirBuster Directory Enumeration Scanner
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13920: HTTP: Microsoft Internet Explorer onmousemove Use-After-Free Vulnerability
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13923: HTTP: Nate Video User Authentication
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
- NGFW Application Groups updated.
13926: HTTP: Nate Video User Authentication
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
- NGFW Application Groups updated.
13927: HTTP: Microsoft Internet Explorer createTextNode Use-After-Free Vulnerability
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13929: HTTP: Online Web Proxy
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13930: HTTPS: SiriusXM Radio User Authentication
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
- NGFW Application Groups updated.
13931: HTTP: McAfee Virtual Technician ActiveX Control Instantiation
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13932: HTTP: Microsoft SharePoint ThemeOverride Cross-Site Scripting Vulnerability
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13942: HTTP: Daum Cafe User Authentication
- IPS Version: 1.0.0 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
- NGFW Application Groups updated.
13944: HTTP: Daum Cafe Mobile Post Message
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
- NGFW Application Groups updated.
13946: HTTP: Daum Cafe Mobile Write Message
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
- NGFW Application Groups updated.
13949: HTTP: Samsung iPOLiS Device Manager ActiveX Control Instantiation (ZDI-14-167)
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13954: HTTPS: KakaoTalk for PC User Authentication
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
- NGFW Application Groups updated.
13955: HTTPS: KakaoTalk for PC File Transfer
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
- NGFW Application Groups updated.
13958: HTTP: KakaoTalk for PC File Download
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
- NGFW Application Groups updated.
13959: HTTP: Adobe Mobile Reader Exposed Public Java Objects
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13963: SMB: acdimres.dll File Access via SMB
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13964: HTTP: acdimres.dll File Access from WebDAV
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13968: TCP: Nate TalkOn User Authentication
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
- NGFW Application Groups updated.
13971: HTTP: Adobe Acrobat Professional Enhanced Metafile (EMF) Buffer Overflow Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13977: HTTP: Splunk Directory Traversal Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13986: HTTP: Samsung iPOLiS Device Manager ActiveX Control Instantiation (ZDI-14-171)
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13987: HTTP: Samsung iPOLiS XNSSDKDEVICE ActiveX Control Instantiation (ZDI-14-169/ZDI-14-170)
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13988: HTTP: Samsung iPOLiS Device Manager Vulnerable Method Calls (ZDI-14-172)
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13989: HTTP: PineApp Mail-SeCure conflivelog Command Injection Vulnerability (ZDI-13-183)
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13991: HTTP: IBM Platform Symphony SOAP Buffer Overflow Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13992: HTTP: Xerox DocuShare SQL Injection Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
* 13993: HTTP: Digium Asterisk Cookie Denial-of-Service Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
13996: HTTP: Symantec LiveUpdate Administrator User Password Reset
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
14003: HTTP: GIMP XWD File Handling Buffer Overflow Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
14006: HTTP: McAfee Asset Manager Directory Traversal Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
14008: HTTP: VideoLAN VLC ABC File Buffer Overflow Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
16217: HTTPS: CyberDust User Authentication
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
- NGFW Application Groups updated.
16218: HTTP: Lighthttpd mod_simple_vhost Directory Traversal Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
16221: HTTP: McAfee Asset Manager SQL Injection Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
16237: HTTP: Lighthttpd mod_mysql_vhost SQL Injection Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
16238: HTTP: McAfee Cloud Single Sign-On ExtensionAccessServlet Directory Traversal Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
16240: HTTP: McAfee ePolicy Orchestrator XML External Entity Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
* 16242: HTTPS: Symantec Messaging Gateway Management Console Cross-Site Scripting Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
16245: HTTP: Advantech WebAccess webvact.ocx ActiveX Control Buffer Overflow (ZDI-14-074/ZDI-14-116)
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
16250: MySQL: Oracle MySQL XPath Denial-of-Service Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
16256: HTTP: Microsoft Internet Explorer Header Element Use-After-Free Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Detection logic updated.
