Summary
Digital Vaccine #9223 January 22, 2019
Details
Thank you for subscribing to Digital Vaccine updates brought to you by Trend Micro™ TippingPoint DVLabs. New content is now available at the Threat Management Center (TMC): https://tmc.tippingpoint.com. SMS customers can update the Digital Vaccine through the SMS client. From the top line menu, you can open the "File > Download Digital Vaccine from TMC" menu item to detect and load the latest update. |
System Requirements |
The 3.2.0 DV will run on IPS devices with TOS v3.2.0 and above, all NGFW and all TPS systems. The 4.0.0 DV will only run on the Virtual Threat Protection System (vTPS) appliance. Please note that vTPS does not currently support pre-disclosed ZDI filters. |
The Digital Vaccine can be manually downloaded from the following URLs: https://tmc.tippingpoint.com/TMC/ViewPackage?parentFolderId=digital_vaccines&contentId=SIG_3.2.0_9223.pkg https://tmc.tippingpoint.com/TMC/ViewPackage?parentFolderId=vsa_dv&contentId=SIG_VTPS_4.0.0_9223.pkg |
Update Details
Table of Contents
--------------------------
Filters
New Filters
Modified Filters (logic changes)
Modified Filters (metadata changes only)
Removed Filters
Filters
----------------
New Filters:
33855: TCP: Oracle GoldenGate Manager Command Tab Parsing Denial-of-Service Vulnerability - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Category: Exploits - Severity: Critical - Description: This filter detects an attempt to exploit a denial-of-service vulnerability in Oracle GoldenGate Manager. - Deployments: - Deployment: Default (Block / Notify) - Deployment: Performance-Optimized (Disabled) - References: - Common Vulnerabilities and Exposures: CVE-2018-2912 33993: HTTP: Datalust Seq isauthenticationenabled Put Request - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Category: Security Policy - Severity: Moderate - Description: This filter detects passing the isauthenticationenabled with a PUT request in Datalust Seq. - Deployment: Not enabled by default in any deployment. - References: - Common Vulnerabilities and Exposures: CVE-2018-8096 34005: HTTP: Artifex Ghostscript Interpreter Memory Corruption Vulnerability - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Category: Vulnerabilities - Severity: Critical - Description: This filter detects an attempt to exploit a memory corruption vulnerability in Artifex Ghostscript. - Deployments: - Deployment: Default (Block / Notify) - Deployment: Performance-Optimized (Disabled) - References: - Common Vulnerabilities and Exposures: CVE-2018-16509 34009: HTTP: Microsoft Edge Chakra GlobOpt Memory Corruption Vulnerability - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Category: Exploits - Severity: Critical - Description: This filter detects an attempt to exploit a memory corruption vulnerability in Microsoft Edge. - Deployments: - Deployment: Security-Optimized (Block / Notify) - References: - Common Vulnerabilities and Exposures: CVE-2018-0770 34010: HTTP: Foxit Reader Annotation subject Use-After-Free Vulnerability (ZDI-18-1202) - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Category: Vulnerabilities - Severity: Critical - Description: This filter detects an attempt to exploit a use-after-free vulnerability in Foxit Reader. - Deployments: - Deployment: Security-Optimized (Block / Notify) - References: - Common Vulnerabilities and Exposures: CVE-2018-17633 - Zero Day Initiative: ZDI-18-1202 34016: HTTP: PHP fopen wrapper Buffer Overflow Vulnerability - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Category: Vulnerabilities - Severity: Critical - Description: This filter detects an attempt to exploit a buffer overflow vulnerability in PHP. - Deployments: - Deployment: Security-Optimized (Block / Notify) - References: - Common Vulnerabilities and Exposures: CVE-2018-7584 34019: HTTP: Easy Hosting Control Panel GET Request Parameter Detection - IPS Version: 3.6.2 and after. - NGFW Version: 1.1.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Category: Security Policy - Severity: Moderate - Description: This filter detects parameters passed to Easy Hosting Control Panel (EHCP). - Deployment: Not enabled by default in any deployment. - References: - Common Vulnerabilities and Exposures: CVE-2018-6458 34020: SIP: Kamailio SIP Register Message Overly Long Branch and Tag Id Detection - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Category: Security Policy - Severity: Low - Description: This filter detects the usage of overly long branch or tag attribute in the Kamailio SIP Register message. - Deployment: Not enabled by default in any deployment. - References: - Common Vulnerabilities and Exposures: CVE-2018-8828 34021: HTTP: Foxit Reader XFA xfdf removeAttribute Use-After-Free Vulnerability (ZDI-18-1163) - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Category: Exploits - Severity: Critical - Description: This filter detects an attempt to exploit a use-after-free vulnerability in the Foxit Reader. - Deployments: - Deployment: Default (Block / Notify) - Deployment: Performance-Optimized (Disabled) - References: - Common Vulnerabilities and Exposures: CVE-2018-17670 - Zero Day Initiative: ZDI-18-1163 34023: TCP: Schneider Electric InduSoft Web Studio and InTouch Machine Buffer Overflow Vulnerability - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Category: Vulnerabilities - Severity: Critical - Description: This filter detects an attempt to exploit a buffer overflow vulnerability in Schneider Electric Indusoft and InTouch. - Deployments: - Deployment: Security-Optimized (Block / Notify) - References: - Bugtraq ID: 103949 - Common Vulnerabilities and Exposures: CVE-2018-8840 34024: HTTP: Foxit Reader XFA host exportData Use-After-Free Vulnerability (ZDI-18-1174) - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Category: Exploits - Severity: Critical - Description: This filter detects an attempt to exploit a use-after-free vulnerability in the Foxit Reader. - Deployments: - Deployment: Default (Block / Notify) - Deployment: Performance-Optimized (Disabled) - References: - Common Vulnerabilities and Exposures: CVE-2018-17666 - Zero Day Initiative: ZDI-18-1174 34025: HTTP: Foxit Reader XFA TimeField getDisplayItem Use-After-Free Vulnerability (ZDI-18-1210) - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Category: Exploits - Severity: Critical - Description: This filter detects an attempt to exploit a use-after-free vulnerability in Foxit Reader. - Deployments: - Deployment: Security-Optimized (Block / Notify) - References: - Common Vulnerabilities and Exposures: CVE-2018-17656 - Zero Day Initiative: ZDI-18-1210 34026: HTTP: Google Chrome V8 Javascript Object Integer Overflow Vulnerability - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Category: Exploits - Severity: Critical - Description: This filter detects an attempt to exploit an integer overflow vulnerability in Google Chrome. - Deployment: Not enabled by default in any deployment. - References: - Common Vulnerabilities and Exposures: CVE-2018-6065 34027: HTTP: Foxit Reader XFA host gotoURL Use-After-Free Vulnerability (ZDI-18-1203) - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Category: Exploits - Severity: Critical - Description: This filter detects an attempt to exploit a use-after-free vulnerability in Foxit Reader. - Deployments: - Deployment: Security-Optimized (Block / Notify) - References: - Common Vulnerabilities and Exposures: CVE-2018-17657 - Zero Day Initiative: ZDI-18-1203 34028: HTTP: Foxit Reader XFA host response Use-After-Free Vulnerability (ZDI-18-1226) - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Category: Exploits - Severity: Critical - Description: This filter detects an attempt to exploit a use-after-free vulnerability in Foxit Reader. - Deployments: - Deployment: Security-Optimized (Block / Notify) - References: - Common Vulnerabilities and Exposures: CVE-2018-17658 - Zero Day Initiative: ZDI-18-1226 34029: HTTP: Foxit Reader XFA host title Use-After-Free Vulnerability (ZDI-18-1206) - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Category: Exploits - Severity: Critical - Description: This filter detects an attempt to exploit a use-after-free vulnerability in Foxit Reader. - Deployments: - Deployment: Security-Optimized (Block / Notify) - References: - Common Vulnerabilities and Exposures: CVE-2018-17659 - Zero Day Initiative: ZDI-18-1206 34030: HTTP: PHP ProjectPier ID Parameter Usage - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Category: Security Policy - Severity: Moderate - Description: This filter detects the usage of the ID parameter when calling "public/patch/patch.php" in ProjectPier. - Deployment: Not enabled by default in any deployment. - References: - Common Vulnerabilities and Exposures: CVE-2018-10759 34031: HTTP: Joomla Component Alexandria Book Library SQL Injection Vulnerability - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Category: Exploits - Severity: Critical - Description: This filter detects an attempt to exploit an SQL injection vulnerability in Joomla Alexandria Book Library. - Deployment: Not enabled by default in any deployment. - References: - Common Vulnerabilities and Exposures: CVE-2018-7312 34036: HTTP: Foxit Reader Host currentPage Use-After-Free Vulnerability (ZDI-18-1178) - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Category: Exploits - Severity: Critical - Description: This filter detects an attempt to exploit a use-after-free vulnerability in the Foxit Reader. - Deployments: - Deployment: Default (Block / Notify) - Deployment: Performance-Optimized (Disabled) - References: - Common Vulnerabilities and Exposures: CVE-2018-17665 - Zero Day Initiative: ZDI-18-1178 34037: SIP: Kamailio SIP Server REGISTER Denial-of-Service Vulnerability (UDP) - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Category: Vulnerabilities - Severity: High - Description: This filter detects an attempt to exploit a denial-of-service vulnerability in the Kamailio SIP server. - Deployments: - Deployment: Default (Block / Notify) - Deployment: Performance-Optimized (Disabled) - References: - Common Vulnerabilities and Exposures: CVE-2018-14767 34038: HTTP: Foxit Reader XFA isCompatibleNS Use-After-Free Vulnerability (ZDI-18-1179) - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Category: Exploits - Severity: Critical - Description: This filter detects an attempt to exploit a use-after-free vulnerability in the Foxit Reader. - Deployments: - Deployment: Default (Block / Notify) - Deployment: Performance-Optimized (Disabled) - References: - Common Vulnerabilities and Exposures: CVE-2018-17664 - Zero Day Initiative: ZDI-18-1179 34039: HTTP: Foxit Reader XFA TimeField resolveNode Use-After-Free Vulnerability (ZDI-18-1220) - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Category: Exploits - Severity: Critical - Description: This filter detects an attempt to exploit a use-after-free vulnerability in the Foxit Reader. - Deployments: - Deployment: Default (Block / Notify) - Deployment: Performance-Optimized (Disabled) - References: - Common Vulnerabilities and Exposures: CVE-2018-17653 - Zero Day Initiative: ZDI-18-1220 34041: SIP: Kamailio SIP Server REGISTER Denial-of-Service Vulnerability (TCP) - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Category: Vulnerabilities - Severity: Critical - Description: This filter detects an attempt to exploit a denial-of-service vulnerability in the Kamailio SIP server. - Deployments: - Deployment: Default (Block / Notify) - Deployment: Performance-Optimized (Disabled) - References: - Common Vulnerabilities and Exposures: CVE-2018-14767 Modified Filters (logic changes): * = Enabled in Default deployments * 27147: HTTP: Adobe Flash Shared Script Object Use-After-Free Vulnerability - IPS Version: 3.1.3 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Detection logic updated. * 28923: HTTPS: AlienVault USM and OSSIM get_fqdn Command Injection Vulnerability - IPS Version: 3.1.3 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Detection logic updated. * 29743: HTTP: Adobe Flash determinePreferredLocales Out-of-Bound Read Vulnerability (ZDI-17-997) - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Detection logic updated. * 30341: HTTP: Microsoft Windows LNK Memory Corruption Vulnerability - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Detection logic updated. * 30362: HTTP: Microsoft Edge JIT Optimization Type Confusion Vulnerability - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Detection logic updated. * 31489: HTTP: Microsoft Edge Scripting Engine Magic Value Memory Corruption Vulnerability (ZDI-18-948) - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Description updated. - Detection logic updated. * 31493: HTTP: Microsoft Windows VBScript Engine Class_Terminate Use-after-Free Vulnerability(ZDI-18-540,613) - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Description updated. - Detection logic updated. - Vulnerability references updated. 31562: HTTP: Microsoft Win32k Elevation of Privilege Vulnerability - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Detection logic updated. - Vulnerability references updated. 31765: HTTP: Squid Reverse Proxy sslBumpAccessCheck Denial-of-Service Vulnerability (ZDI-18-309) - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Detection logic updated. 31851: DHCP: Red Hat Fedora DHCP Client NetworkManager Input Validation Vulnerability - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Detection logic updated. * 33132: HTTP: Microsoft Windows Script Command Injection Vulnerability - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Description updated. - Detection logic updated. - Vulnerability references updated. * 33293: HTTP: Microsoft Windows gd132full PlayEnhMetaFile Out-Of-Bounds Read Vulnerability (ZDI-18-1404) - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Name changed from "33293: ZDI-CAN-6515: Zero Day Initiative Vulnerability (Microsoft Windows)". - Description updated. - Detection logic updated. - Vulnerability references updated. 33363: HTTP: OMRON CX-One CX-Position NCI File Parsing Buffer Overflow (ZDI-18-1366) - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Name changed from "33363: ZDI-CAN-6603: Zero Day Initiative Vulnerability (OMRON CX-One)". - Description updated. - Detection logic updated. - Vulnerability references updated. 33364: HTTP: OMRON CX-One CX-Programmer CXP File Parsing Use-After-Free Vulnerability (ZDI-18-1367) - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Name changed from "33364: ZDI-CAN-6608: Zero Day Initiative Vulnerability (OMRON CX-One)". - Description updated. - Detection logic updated. - Vulnerability references updated. 33365: HTTP: OMRON CX-One CXP File Parsing Buffer Overflow Vulnerability (ZDI-18-1368) - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Name changed from "33365: ZDI-CAN-6610: Zero Day Initiative Vulnerability (OMRON CX-One)". - Description updated. - Detection logic updated. - Vulnerability references updated. 33463: HTTP: Microsoft Office Excel XLS File Out-Of-Bounds Read Vulnerability (ZDI-18-1424) - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Name changed from "33463: ZDI-CAN-6918: Zero Day Initiative Vulnerability (Microsoft Office Excel)". - Description updated. - Detection logic updated. - Vulnerability references updated. 33464: HTTP: Microsoft Office Excel gdiplus EMF File Parsing Out-Of-Bounds Read Vulnerability (ZDI-18-1403) - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Name changed from "33464: ZDI-CAN-7256: Zero Day Initiative Vulnerability (Microsoft Office Excel)". - Description updated. - Detection logic updated. - Vulnerability references updated. 33536: HTTP: Schneider Electric GUIcon GD1 File Parsing Type Confusion Vulnerability (ZDI-18-1411) - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Name changed from "33536: ZDI-CAN-6959: Zero Day Initiative Vulnerability (Schneider Electric GUIcon)". - Description updated. - Detection logic updated. - Vulnerability references updated. 33537: HTTP: Schneider Electric GUIcon GD1 File Parsing Buffer Overflow Vulnerability (ZDI-18-1409) - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Name changed from "33537: ZDI-CAN-6960: Zero Day Initiative Vulnerability (Schneider Electric GUIcon)". - Description updated. - Detection logic updated. - Vulnerability references updated. 33538: HTTP: Schneider Electric GUIcon GD1 File Parsing Type Confusion Vulnerability (ZDI-18-1410) - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Name changed from "33538: ZDI-CAN-6965: Zero Day Initiative Vulnerability (Schneider Electric GUIcon)". - Description updated. - Detection logic updated. - Vulnerability references updated. 33571: HTTP: Microsoft Office Excel XLS File Out-Of-Bounds Read Vulnerability (ZDI-18-1405) - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Name changed from "33571: ZDI-CAN-6901: Zero Day Initiative Vulnerability (Microsoft Office Excel)". - Description updated. - Detection logic updated. - Vulnerability references updated. 33646: HTTP: Microsoft Windows JET Database Engine Uninitialized Pointer Vulnerability (ZDI-19-008) - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Name changed from "33646: ZDI-CAN-7267: Zero Day Initiative Vulnerability (Microsoft Windows)". - Description updated. - Detection logic updated. - Vulnerability references updated. 33647: HTTP: Microsoft Windows JET Database Engine Out-of-Bounds Write Vulnerability (ZDI-19-010) - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Name changed from "33647: ZDI-CAN-7268: Zero Day Initiative Vulnerability (Microsoft Windows)". - Description updated. - Detection logic updated. - Vulnerability references updated. * 33696: HTTP: Microsoft Windows gdiplus GdipGetWinMetaFileBitsEx Out-Of-Bounds Read (ZDI-18-1430) - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Name changed from "33696: ZDI-CAN-7427: Zero Day Initiative Vulnerability (Microsoft Windows)". - Description updated. - Detection logic updated. - Vulnerability references updated. Modified Filters (metadata changes only): * = Enabled in Default deployments 33650: HTTP: Apache2 mod_http2 header Denial-of-Service Vulnerability (ZDI-18-1369) - IPS Version: 3.6.2 and after. - NGFW Version: 1.0.0 and after. - TPS Version: 4.0.0 and after. - vTPS Version: 4.0.1 and after. - Name changed from "33650: ZDI-CAN-7168: Zero Day Initiative Vulnerability (Apache HTTPD Server 2.x)". - Description updated. - Vulnerability references updated. Removed Filters: None
Top of the Page