Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Digital Vaccine #9243

    • Updated:
    • 27 Feb 2019
    • Product/Version:
    • TippingPoint Digital Vaccine
    • Platform:
Summary
Digital Vaccine #9243      February 26, 2019
Details
Public
Thank you for subscribing to Digital Vaccine updates brought to you by Trend Micro™ TippingPoint DVLabs.

New content is now available at the Threat Management Center (TMC): https://tmc.tippingpoint.com.

SMS customers can update the Digital Vaccine through the SMS client. From the top line menu, you can open the "File > Download Digital Vaccine from TMC" menu item to detect and load the latest update.
 
System Requirements
The 3.2.0 DV will run on IPS devices with TOS v3.2.0 and above,  all NGFW and all TPS systems.
The 4.0.0 DV will only run on the Virtual Threat Protection System (vTPS) appliance.
Please note that vTPS does not currently support pre-disclosed ZDI filters.
 
The Digital Vaccine can be manually downloaded from the following URLs:
https://tmc.tippingpoint.com/TMC/ViewPackage?parentFolderId=digital_vaccines&contentId=SIG_3.2.0_9243.pkg
https://tmc.tippingpoint.com/TMC/ViewPackage?parentFolderId=vsa_dv&contentId=SIG_VTPS_4.0.0_9243.pkg

Update Details

Table of Contents
--------------------------

Filters
 New Filters - 17
 Modified Filters (logic changes) - 28
 Modified Filters (metadata changes only) - 3
 Removed Filters - 3

Filters
----------------
 New Filters:
    32748: HTTP: Delta Industrial Automation TPEditor File Parsing Buffer Overflow Vulnerability (ZDI-18-1240)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Category: Exploits
      - Severity: Critical
      - Description: This filter detects an attempt to exploit a buffer overflow vulnerability in Delta Industrial Automation TPEditor.
      - Deployments:
        - Deployment: Security-Optimized (Block / Notify)
      - References:
        - Common Vulnerabilities and Exposures: CVE-2018-17929
        - Zero Day Initiative: ZDI-18-1240

    32749: HTTP: Delta Industrial Automation TPEditor File Parsing Buffer Overflow Vulnerability (ZDI-18-1241)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Category: Exploits
      - Severity: Critical
      - Description: This filter detects an attempt to exploit a buffer overflow vulnerability in Delta Industrial Automation TPEditor.
      - Deployments:
        - Deployment: Security-Optimized (Block / Notify)
      - References:
        - Common Vulnerabilities and Exposures: CVE-2018-17929
        - Zero Day Initiative: ZDI-18-1241

    33640: HTTP: GET Request with Empty Host Field
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Category: Security Policy
      - Severity: Moderate
      - Description: This filter detects an attempt to transfer an HTTP GET request with an empty string in the Host field.
      - Deployment: Not enabled by default in any deployment.
      - References:
        - Common Vulnerabilities and Exposures: CVE-2018-18778 CVSS 4.0

    33872: HTTP: Netgate pfSense system_advanced_misc.php Command Injection Vulnerability
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Category: Vulnerabilities
      - Severity: Critical
      - Description: This filter detects an attempt to exploit a command injection vulnerability in Netgate pfSense.
      - Deployments:
        - Deployment: Security-Optimized (Block / Notify)
      - References:
        - Common Vulnerabilities and Exposures: CVE-2018-4019 CVSS 6.5, CVE-2018-4020 CVSS 6.5, CVE-2018-4021 CVSS 6.5

    34457: HTTP: phpMyAdmin pma__column_info Local File Inclusion Vulnerability
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Category: Vulnerabilities
      - Severity: Critical
      - Description: This filter detects an attempt to exploit a file inclusion vulnerability in phpMyAdmnin.
      - Deployments:
        - Deployment: Security-Optimized (Block / Notify)
      - References:
        - Bugtraq ID: 106178
        - Common Vulnerabilities and Exposures: CVE-2018-19968 CVSS 4.0

    34459: HTTP: Nuxeo CMS Expression Language Injection Vulnerability
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Category: Vulnerabilities
      - Severity: Critical
      - Description: This filter detects an attempt to exploit a language injection vulnerability in Nuxeo CMS.
      - Deployments:
        - Deployment: Security-Optimized (Block / Notify)
      - References:
        - Common Vulnerabilities and Exposures: CVE-2018-16341

    34464: HTTP: Cross-Site Scripting Characters in a Search Query String
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Category: Security Policy
      - Severity: Moderate
      - Description: This filter detects the presence of common cross-site scripting characters in a search query string.
      - Deployment: Not enabled by default in any deployment.

    34477: HTTP: Adobe Flash Player SetInterval Use-After-Free Vulnerability
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Category: Exploits
      - Severity: Critical
      - Description: This filter detects an attempt to exploit a use-after-free vulnerability in Adobe Flash Player.
      - Deployments:
        - Deployment: Security-Optimized (Block / Notify)
      - References:
        - Common Vulnerabilities and Exposures: CVE-2016-0988

    34478: HTTP: Adobe Flash Player SetInterval Use-After-Free Vulnerability (Upload)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Category: Exploits
      - Severity: Critical
      - Description: This filter detects an attempt to exploit a use-after-free vulnerability in Adobe Flash Player.
      - Deployments:
        - Deployment: Security-Optimized (Block / Notify)
      - References:
        - Common Vulnerabilities and Exposures: CVE-2016-0988

    34487: HTTP: Kubernetes Dashboard Authentication Bypass Vulnerability
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Category: Vulnerabilities
      - Severity: Critical
      - Description: This filter detects an attempt to exploit an authentication bypass vulnerability in Kubernetes.
      - Deployments:
        - Deployment: Default (Block / Notify)
        - Deployment: Performance-Optimized (Disabled)
      - References:
        - Bugtraq ID: 106493
        - Common Vulnerabilities and Exposures: CVE-2018-18264 CVSS 5.0

    34488: HTTPS: Kubernetes Dashboard Authentication Bypass Vulnerability
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Category: Vulnerabilities
      - Severity: Critical
      - Description: This filter detects an attempt to exploit an authentication bypass vulnerability in Kubernetes.
      - Deployments:
        - Deployment: Default (Block / Notify)
        - Deployment: Performance-Optimized (Disabled)
      - References:
        - Bugtraq ID: 106493
        - Common Vulnerabilities and Exposures: CVE-2018-18264 CVSS 5.0

    34489: HTTP: Zoho ManageEngine OpManager BusinessViewFlashImpl handleBVAction XXE Injection Vulnerability
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Category: Vulnerabilities
      - Severity: High
      - Description: This filter detects an attempt to exploit an XML External Entity injection vulnerability in Zoho ManageEngine OpManager.
      - Deployments:
        - Deployment: Security-Optimized (Block / Notify)
      - References:
        - Common Vulnerabilities and Exposures: CVE-2018-18980 CVSS 5.0

    34490: HTTP: Adobe Flash Player loadPCMFromByteArray Use-After-Free Vulnerability (Upload)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Category: Exploits
      - Severity: Critical
      - Description: This filter detects an attempt to exploit a use-after-free vulnerability in Adobe Flash Player.
      - Deployments:
        - Deployment: Security-Optimized (Block / Notify)
      - References:
        - Common Vulnerabilities and Exposures: CVE-2016-0984

    34564: ZDI-CAN-7878,7879: Zero Day Initiative Vulnerability (Advantech WebAccess Node)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: Not available.
      - Requires: N/NX-Platform, NGFW, or TPS devices
      - Category: Vulnerabilities
      - Severity: Critical
      - Description: This filter provides protection against exploitation of a zero-day vulnerability affecting Advantech WebAccess Node.
      - Deployments:
        - Deployment: Security-Optimized (Block / Notify)

    34573: HTTP: WordPress Image Remote Code Execution Vulnerability
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Category: Vulnerabilities
      - Severity: Critical
      - Description: This filter detects an attempt to exploit a remote code execution vulnerability in WordPress.
      - Deployments:
        - Deployment: Security-Optimized (Block / Notify)
      - References:
        - Bugtraq ID: 107088
        - Common Vulnerabilities and Exposures: CVE-2019-8942 CVSS 6.5

    34578: HTTP: Drupal RESTful Web Services Code Injection Vulnerability
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Category: Vulnerabilities
      - Severity: Critical
      - Description: This filter detects an attempt to exploit a insecure deserialization vulnerability in the Drupal RESTful Web Services Module.
      - Deployments:
        - Deployment: Security-Optimized (Block / Notify)
      - References:
        - Common Vulnerabilities and Exposures: CVE-2019-6340

    34590: HTTP: Suspicious PHP Parameter Usage in WordPress
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Category: Security Policy
      - Severity: Moderate
      - Description: This filter detects the presence of a malformed parameter consisting of a php filename when uploading a file to the WordPress core media directory.
      - Deployment: Not enabled by default in any deployment.
      - References:
        - Bugtraq ID: 107089
        - Common Vulnerabilities and Exposures: CVE-2019-8943 CVSS 4.0

  Modified Filters (logic changes):
    * = Enabled in Default deployments

    * 23762: HTTP: Adobe Flash Player loadPCMFromByteArray Use-After-Free Vulnerability
      - IPS Version: 3.1.3 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Description updated.
      - Detection logic updated.

    31162: TCP: Cisco Smart Install Code Execution Vulnerability
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "31162: TCP: Cisco Smart Install Buffer Overflow Vulnerability".
      - Category changed from "Vulnerabilities" to "Exploits".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    31495: HTTP: Trend Micro Encryption for Email Gateway SQL Injection Vulnerability (ZDI-18-418)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "31495: ZDI-CAN-5550: Zero Day Initiative Vulnerability (Trend Micro Encryption for Email Gateway)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    31496: HTTP: Trend Micro Encryption for Email Gateway Client SQL Injection Vulnerability (ZDI-18-415)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "31496: ZDI-CAN-5551 Zero Day Initiative Vulnerability (Trend Micro Encryption for Email Gateway)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    31619: HTTP: Trend Micro Encryption for Email Gateway emailSearch SQL Injection Vulnerability (ZDI-18-417)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "31619: ZDI-CAN-5553: Zero Day Initiative Vulnerability (Trend Micro Encryption for Email Gateway)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    31625: HTTP: Trend Micro Encryption for Email Gateway SQL Injection Vulnerability (ZDI-18-420)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "31625: ZDI-CAN-5592: Zero Day Initiative Vulnerability (Trend Micro Encryption for Email Gateway)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    31626: HTTP: Trend Micro Encryption for Email Gateway SQL Injection Vulnerability (ZDI-18-419)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "31626: ZDI-CAN-5594: Zero Day Initiative Vulnerability (Trend Micro Encryption for Email Gateway)".
      - Severity changed from "Critical" to "High".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    31627: HTTP: Advantech WebAccess Node BWSCADASoap GetTrendList SQL Injection Vulnerability (ZDI-18-475)
      - IPS Version: 3.0.0 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "31627: ZDI-CAN-5595: Zero Day Initiative Vulnerability (Advantech WebAccess Node)".
      - Severity changed from "Critical" to "High".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    31628: HTTP: Advantech WebAccess Node BWSCADASoap PointListByPage SQL Injection Vulnerability (ZDI-18-473)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "31628: ZDI-CAN-5596: Zero Day Initiative Vulnerability (Advantech WebAccess Node)".
      - Severity changed from "Critical" to "High".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    31954: RPC: Advantech WebAccess Node screnc Buffer Overflow Vulnerability (ZDI-18-498,1298)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "31954: HTTP: Advantech WebAccess Node screnc Buffer Overflow Vulnerability (ZDI-18-498)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    32745: HTTP: Adobe Acrobat ProDC U3D TIFF Parsing Out-of-Bounds Read Vulnerability (ZDI-18-1427)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "32745: ZDI-CAN-6590: Zero Day Initiative Vulnerability (Adobe Acrobat Pro DC)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    32790: HTTP: Wecon LeviStudioU screendata LaIndexID/TextContent Buffer Overflow Vulnerability (ZDI-19-146)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "32790: ZDI-CAN-6493: Zero Day Initiative Vulnerability (WECON LeviStudioU)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    * 32954: HTTP: Adobe Acrobat Pro DC HTML2PDF Parsing Out-Of-Bounds Read Vulnerability (ZDI-18-1073)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Severity changed from "Critical" to "High".
      - Detection logic updated.
      - Vulnerability references updated.

    33118: HTTP: Quest KACE Systems Management run_report Command Injection Vulnerability (ZDI-18-1065)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Description updated.
      - Detection logic updated.

    33145: HTTP: LAquis SCADA acompanhamentotela Command Injection Vulnerability (ZDI-19-062,ZDI-19-063)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "33145: ZDI-CAN-6672,6673: Zero Day Initiative Vulnerability (LAquis SCADA)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    33146: HTTP: LAquis SCADA relatorioindividual TITULO Command Injection Vulnerability (ZDI-19-061)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "33146: ZDI-CAN-6671: Zero Day Initiative Vulnerability (LAquis SCADA)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    33319: HTTP: Adobe Acrobat Pro DC Preflight setDefaultLibrary Use-After-Free Vulnerability (ZDI-19-001)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "33319: ZDI-CAN-6656: Zero Day Initiative Vulnerability (Adobe Reader)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    33385: HTTP: Adobe Acrobat Pro DC EMF Parsing Pointer Dereference Vulnerability (ZDI-18-1421)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "33385: ZDI-CAN-6720: Zero Day Initiative Vulnerability (Adobe Acrobat Pro DC)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    33386: HTTP: Adobe Acrobat Pro DC EMF Parsing Out-Of-Bounds Read Vulnerability (ZDI-18-1428)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "33386: ZDI-CAN-6721: Zero Day Initiative Vulnerability (Adobe Acrobat Pro DC)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    * 33470: HTTP: Adobe Acrobat Reader HTML2PDF Use-After-Free Vulnerability (ZDI-18-1414)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "33470: ZDI-CAN-6772: Zero Day Initiative Vulnerability (Adobe Acrobat Pro DC)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    33603: HTTP: Adobe Acrobat Reader HTML2PDF Use-After-Free Vulnerability (ZDI-18-1416)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "33603: ZDI-CAN-6947: Zero Day Initiative Vulnerability (Adobe Reader)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    * 33658: HTTP: Adobe Acrobat Pro DC ImageConversion XPS Parsing Out-Of-Bounds Read Vulnerability(ZDI-18-1398)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "33658: ZDI-CAN-7354: Zero Day Initiative Vulnerability (Adobe Acrobat Pro DC)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    33674: HTTP: Microsoft Visual Studio wpa Protocol XML Information Disclosure Vulnerability (ZDI-19-016)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "33674: ZDI-CAN-7251: Zero Day Initiative Vulnerability (Microsoft Visual Studio)".
      - Severity changed from "Critical" to "High".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    33694: HTTP: Microsoft Windows gdiplus bParseWin32Metafile Out-Of-Bounds Read Vulnerability (ZDI-18-1429)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "33694: ZDI-CAN-7382: Zero Day Initiative Vulnerability (Microsoft Windows)".
      - Severity changed from "Critical" to "High".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    33877: HTTP: OMRON CX-Supervisor SCS File Parsing Memory Corruption Vulnerability (ZDI-19-174)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "33877: ZDI-CAN-6717: Zero Day Initiative Vulnerability (OMRON CX-Supervisor)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    33901: HTTP: Microsoft Windows contact File UI Warning Memory Corruption Vulnerability (ZDI-19-121)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "33901: ZDI-CAN-7591: Zero Day Initiative Vulnerability (Microsoft Windows)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    * 33952: HTTP: Oracle Outside In vsxl5 GelFrame Record Out-Of-Bounds Read Vulnerability (ZDI-19-039)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "33952: ZDI-CAN-7592: Zero Day Initiative Vulnerability (Oracle Outside In)".
      - Severity changed from "Critical" to "High".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    33978: HTTP: Foxit PhantomPDF setInterval Use-After-Free Vulnerability (ZDI-19-140)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "33978: ZDI-CAN-7452: Zero Day Initiative Vulnerability (Foxit PhantomPDF)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

  Modified Filters (metadata changes only):
    * = Enabled in Default deployments

    * 31493: HTTP: Microsoft Windows VBScript Class_Terminate Use-after-Free Vulnerability(ZDI-18-540,613,1055)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "31493: HTTP: Microsoft Windows VBScript Engine Class_Terminate Use-after-Free Vulnerability(ZDI-18-540,613)".
      - Description updated.
      - Vulnerability references updated.

    31847: RPC: Advantech WebAccess Node webvrpcs ViewDll1 Buffer Overflow Vulnerability (ZDI-18-490,1300)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "31847: RPC: Advantech WebAccess Node webvrpcs ViewDll1 Buffer Overflow Vulnerability (ZDI-18-490)".
      - Description updated.
      - Vulnerability references updated.

    32250: RPC: Advantech WebAccess Node webvrpcs Arbitrary File Deletion Vulnerability (ZDI-18-499,1299)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "32250: RPC: Advantech WebAccess Node webvrpcs Arbitrary File Deletion Vulnerability (ZDI-18-499)".
      - Description updated.
      - Vulnerability references updated.
      - Deployments updated and are now:
        - Deployment: Security-Optimized (Block / Notify)

  Removed Filters:

    32971: HTTP: Adobe Acrobat Pro ImageConversion Out-of-Bounds Read Vulnerability
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.

    33756: HTTP: Adobe Acrobat Reader Javascript Use-After-Free Vulnerability
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.

    33804: HTTP: Adobe Acrobat Reader XPS Out-of-Bounds Read Vulnerability
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      


Top of the Page
Premium
Internal
Rating:
Category:
Configure; Troubleshoot; Deploy
Solution Id:
TP000126801
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.