Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Digital Vaccine #9324

    • Updated:
    • 4 Sep 2019
    • Product/Version:
    • TippingPoint Digital Vaccine
    • Platform:
Summary
Digital Vaccine #9324      September 3, 2019
Details
Public
Thank you for subscribing to Digital Vaccine updates brought to you by Trend Micro™ TippingPoint DVLabs.

New content is now available at the Threat Management Center (TMC): https://tmc.tippingpoint.com.

SMS customers can update the Digital Vaccine through the SMS client. From the top line menu, you can open the "File > Download Digital Vaccine from TMC" menu item to detect and load the latest update.
 
System Requirements
The 3.2.0 DV will run on IPS devices with TOS v3.2.0 and above,  all NGFW and all TPS systems.
The 4.0.0 DV will only run on the Virtual Threat Protection System (vTPS) appliance.
Please note that vTPS does not currently support pre-disclosed ZDI filters.
 
The Digital Vaccine can be manually downloaded from the following URLs:
https://tmc.tippingpoint.com/TMC/ViewPackage?parentFolderId=digital_vaccines&contentId=SIG_3.2.0_9324.pkg
https://tmc.tippingpoint.com/TMC/ViewPackage?parentFolderId=vsa_dv&contentId=SIG_VTPS_4.0.0_9324.pkg

Update Details

Table of Contents
--------------------------

Filters
 New Filters - 9
 Modified Filters (logic changes) - 30
 Modified Filters (metadata changes only) - 6
 Removed Filters - 1

Filters
----------------
 New Filters:

    33107: HTTP: LAquis SCADA LGX Report Multiple Methods Information Disclosure (ZDI-19-086 - 089)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Category: Vulnerabilities
      - Severity: Critical
      - Description: This filter detects an attempt to exploit an information disclosure vulnerability in LAquis SCADA.
      - Deployments:
        - Deployment: Security-Optimized (Block / Notify)
      - References:
        - Bugtraq ID: 106634
        - Common Vulnerabilities and Exposures: CVE-2018-18988 CVSS 8.3
        - Zero Day Initiative: ZDI-19-086, ZDI-19-087, ZDI-19-088, ZDI-19-089
      - Classification: Vulnerability - Input Validation (Command injection, XSS, SQL injection, etc)
      - Protocol: HTTP
      - Platform: Windows Client Application

    36080: HTTP: AWStats Log Analyzer Suspicious Debug Information Access
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Category: Security Policy
      - Severity: Low
      - Description: This filter detects an attempt to access debug information from AWStats Log Analyzer.
      - Deployment: Not enabled by default in any deployment.
      - References:
        - Common Vulnerabilities and Exposures: CVE-2005-0438
      - Classification: Security Policy - Forbidden Application Access or Service Request
      - Protocol: HTTP
      - Platform: Multi-Platform Client Application

    36081: HTTP: User-Agent WindowsPowerShell Header Usage
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Category: Security Policy
      - Severity: Low
      - Description: This filter detects the usage of the WindowsPowerShell User-Agent in an HTTP request.
      - Deployment: Not enabled by default in any deployment.
      - Classification: Security Policy - Other
      - Protocol: HTTP
      - Platform: Windows Client Application

    36082: HTTP: XStream Library ReflectionConverter Insecure Deserialization Vulnerability 
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Category: Vulnerabilities
      - Severity: Critical
      - Description: This filter detects an attempt to exploit the insecure deserialization vulnerability in XStream Library ReflectionConverter.
      - Deployments:
        - Deployment: Security-Optimized (Block / Notify)
      - References:
        - Common Vulnerabilities and Exposures: CVE-2019-10173 CVSS 7.5
      - Classification: Vulnerability - Other
      - Protocol: HTTP
      - Platform: Multi-Platform Server Application or Service

    36084: HTTP: Webmin upload.cgi Suspicious File Upload
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Category: Security Policy
      - Severity: Moderate
      - Description: This filter detects an attempt to upload a suspicious file to Webmin.
      - Deployment: Not enabled by default in any deployment.
      - References:
        - Common Vulnerabilities and Exposures: CVE-2019-9624
      - Classification: Vulnerability - Input Validation (Command injection, XSS, SQL injection, etc)
      - Protocol: HTTP
      - Platform: Multi-Platform Server Application or Service

    36086: HTTP: AWStats Totals multisort Code Injection Vulnerability
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Category: Vulnerabilities
      - Severity: Critical
      - Description: This filter detects an attempt to exploit a code injection vulnerability in AWStats Totals.
      - Deployments:
        - Deployment: Security-Optimized (Block / Notify)
      - References:
        - Common Vulnerabilities and Exposures: CVE-2008-3922
      - Classification: Vulnerability - Input Validation (Command injection, XSS, SQL injection, etc)
      - Protocol: HTTP
      - Platform: Multi-Platform Client Application

    36088: TCP: Redis HyperLogLog hllCount Buffer Overflow Vulnerability
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Category: Exploits
      - Severity: Critical
      - Description: This filter detects an attempt to exploit a buffer overflow vulnerability in Redis HyperLogLog.
      - Deployments:
        - Deployment: Security-Optimized (Block / Notify)
      - References:
        - Bugtraq ID: 109290
        - Common Vulnerabilities and Exposures: CVE-2019-10193
      - Classification: Vulnerability - Buffer/Heap Overflow
      - Protocol: TCP (Generic)
      - Platform: Multi-Platform Server Application or Service

    36095: HTTP: Pulse Secure Pulse Connect Secure options Command Injection Vulnerability
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Category: Vulnerabilities
      - Severity: Critical
      - Description: This filter detects an attempt to exploit a command injection vulnerability in Pulse Secure Pulse Connect Secure.
      - Deployments:
        - Deployment: Default (Block / Notify)
        - Deployment: Performance-Optimized (Disabled)
      - References:
        - Common Vulnerabilities and Exposures: CVE-2019-11539
      - Classification: Vulnerability - Input Validation (Command injection, XSS, SQL injection, etc)
      - Protocol: HTTP
      - Platform: UNIX/Linux Server Application or Service

    36097: ZDI-CAN-9229,9230,9231,9232: Zero Day Initiative Vulnerability (Advantech WISE-PaaS/RMM)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: Not available.
      - Requires: N/NX-Platform, NGFW, or TPS devices
      - Category: Vulnerabilities
      - Severity: Critical
      - Description: This filter provides protection against exploitation of a zero-day vulnerability affecting Advantech WISE-PaaS/RMM.
      - Deployments:
        - Deployment: Security-Optimized (Block / Notify / Trace)
      - Classification: Vulnerability - Other
      - Protocol: Other Protocol
      - Platform: Other Server Application or Service

  Modified Filters (logic changes):
    * = Enabled in Default deployments

    33162: HTTP: Microsoft Windows vcf File Security Bypass Vulnerability (ZDI-19-013)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "33162: ZDI-CAN-6920: Zero Day Initiative Vulnerability (Microsoft Windows)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    33311: HTTP: OMRON CX-Supervisor sr3 Code Execution Vulnerability (ZDI-19-100, 101, 103, 105 - 111)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "33311: ZDI-CAN-6636-6639, ZDI-CAN-6641-6647: Zero Day Initiative Vulnerability (OMRON CX-Supervisor)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    33458: HTTP: LAquis SCADA LQS File Parsing Code Execution Vulnerability (ZDI-19-097)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "33458: ZDI-CAN-7110: Zero Day Initiative Vulnerability (LAquis SCADA)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    33535: HTTP: Unity com.unity3d.kharma Protocol Command Injection Vulnerability (ZDI-19-252)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "33535: ZDI-CAN-7242: Zero Day Initiative Vulnerability (Microsoft Visual Studio)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    * 33582: HTTP: Xiaomi Browser WebAssembly Out-Of-Bounds Write Vulnerability (PWN2OWN, ZDI-19-366)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "33582: PWN2OWN ZDI-CAN-7466: Zero Day Initiative Vulnerability (Xiaomi Browser)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    33584: HTTP: Xiaomi Browser Redirect Improper Authorization Vulnerability (PWN2OWN, ZDI-19-284)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "33584: PWN2OWN ZDI-CAN-7468: Zero Day Initiative Vulnerability (Xiaomi Browser)".
      - Severity changed from "Critical" to "High".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    * 33585: HTTP: Xiaomi Browser downloadAndInstallAp Improper Authorization Vulnerability (PWN2OWN, ZDI-19-283)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "33585: PWN2OWN ZDI-CAN-7469: Zero Day Initiative Vulnerability (Xiaomi Browser)".
      - Severity changed from "Critical" to "High".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    33587: HTTP: Xiaomi Browser apkPath Command Injection Vulnerability (PWN2OWN, ZDI-19-285)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "33587: PWN2OWN ZDI-CAN-7484: Zero Day Initiative Vulnerability (Xiaomi Browser)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    33617: HTTP: HPE Intelligent Management Center CommonUtils Directory Traversal Vulnerability (ZDI-19-250)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "33617: ZDI-CAN-7049: Zero Day Initiative Vulnerability (HPE Intelligent Management Center)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    33618: HTTP: HPE Intelligent Management Center Unrestricted File Upload Remote Code Execution (ZDI-19-251)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "33618: ZDI-CAN-7050: Zero Day Initiative Vulnerability (HPE Intelligent Management Center)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    33651: HTTP: Microsoft Windows JET Database Engine Out-Of-Bounds Write Vulnerability (ZDI-19-221)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "33651: ZDI-CAN-7269: Zero Day Initiative Vulnerability (Microsoft Windows)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    33867: HTTP: Microsoft Windows JET Database Engine Out-Of-Bounds Read Vulnerability (ZDI-19-222)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "33867: ZDI-CAN-7313: Zero Day Initiative Vulnerability (Microsoft JET Database)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    33873: HTTP: Microsoft Windows JET Database Engine Out-Of-Bounds Write Vulnerability (ZDI-19-278)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "33873: ZDI-CAN-7336: Zero Day Initiative Vulnerability (Microsoft JET Database)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    33920: HTTP: LAquis SCADA ELS Users.name Out-Of-Bounds Write Vulnerability (ZDI-19-307)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "33920: ZDI-CAN-7374: Zero Day Initiative Vulnerability (LAquis SCADA)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    33921: HTTP: Microsoft Access Database Engine ACECORE Out-Of-Bounds Write Vulnerability (ZDI-19-224)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "33921: ZDI-CAN-7385: Zero Day Initiative Vulnerability (Microsoft Windows)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    33987: HTTP: HPE Intelligent Management Center Expression Language Injection Vulnerability (ZDI-19-453) 
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    34245: DHCP: Microsoft Windows DHCP Client Integer Underflow Vulnerability (ZDI-19-272)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "34245: ZDI-CAN-7822: Zero Day Initiative Vulnerability (Microsoft Windows)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    34575: HTTP: Adobe Acrobat Pro DC PostScript Parsing Out-Of-Bounds Read Vulnerability (ZDI-19-352)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "34575: ZDI-CAN-7965: Zero Day Initiative Vulnerability (Adobe Acrobat Pro DC)".
      - Severity changed from "Critical" to "High".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    * 34577: HTTP: Adobe Bridge CC PNG File Parsing Out-Of-Bounds Read Vulnerability (ZDI-19-351)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "34577: ZDI-CAN-7585: Zero Day Initiative Vulnerability (Adobe Acrobat Pro DC)".
      - Severity changed from "Critical" to "High".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    34592: HTTP: Delta Industrial CNCSoft ScreenEditor wTextLen Buffer Overflow Vulnerability (ZDI-19-399)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "34592: ZDI-CAN-7807: Zero Day Initiative Vulnerability (Delta Industrial Automation CNCSoft ScreenEditor)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    34593: HTTP: Delta Industrial CNCSoft ScreenEditor wMessageLen Buffer Overflow Vulnerability (ZDI-19-400)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "34593: ZDI-CAN-7808: Zero Day Initiative Vulnerability (Delta Industrial Automation CNCSoft ScreenEditor)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    34594: HTTP: Delta Industrial CNCSoft ScreenEditor wMessageLen Buffer Overflow Vulnerability (ZDI-19-401)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "34594: ZDI-CAN-7809: Zero Day Initiative Vulnerability (Delta Industrial Automation CNCSoft ScreenEditor)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    34595: HTTP: Delta Industrial CNCSoft ScreenEditor wFontTextLen Buffer Overflow Vulnerability (ZDI-19-402)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "34595: ZDI-CAN-7810: Zero Day Initiative Vulnerability (Delta Industrial Automation CNCSoft ScreenEditor)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    34596: HTTP: Delta Industrial CNCSoft ScreenEditor wMessageLen Buffer Overflow Vulnerability (ZDI-19-403)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "34596: ZDI-CAN-7811: Zero Day Initiative Vulnerability (Delta Industrial Automation CNCSoft ScreenEditor)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    34597: HTTP: Delta Industrial CNCSoft ScreenEditor wKPFStringLen Buffer Overflow Vulnerability (ZDI-19-404)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "34597: ZDI-CAN-7812: Zero Day Initiative Vulnerability (Delta Industrial Automation CNCSoft ScreenEditor)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    34598: HTTP: Delta Industrial CNCSoft ScreenEditor wTextLen Buffer Overflow Vulnerability (ZDI-19-405)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "34598: ZDI-CAN-7813: Zero Day Initiative Vulnerability (Delta Industrial Automation CNCSoft ScreenEditor)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    34599: HTTP: Delta Industrial CNCSoft ScreenEditor Out-of-Bounds Read Vulnerability (ZDI-19-406)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "34599: ZDI-CAN-7814: Zero Day Initiative Vulnerability (Delta Industrial Automation CNCSoft ScreenEditor)".
      - Severity changed from "Critical" to "High".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    34600: HTTP: Delta Industrial Automation CNCSoft ScreenEditor DPB wTextLen Out-Of-Bounds Read (ZDI-19-409)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "34600: ZDI-CAN-7815: Zero Day Initiative Vulnerability (Delta Industrial Automation CNCSoft ScreenEditor)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    34601: HTTP: Delta Industrial Automation CNCSoft ScreenEditor DPB PanelName Buffer Overflow (ZDI-19-410)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "34601: ZDI-CAN-7823: Zero Day Initiative Vulnerability (Delta Industrial Automation CNCSoft ScreenEditor)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

    34602: HTTP: Delta Industrial Automation CNCSoft ScreenEditor DPB Out-Of-Bound Read (ZDI-19-407)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "34602: ZDI-CAN-7826: Zero Day Initiative Vulnerability (Delta Industrial Automation CNCSoft ScreenEditor)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.

  Modified Filters (metadata changes only):
    * = Enabled in Default deployments

    22622: HTTP: ThinkPHP Framework Code Injection Vulnerability
      - IPS Version: 3.1.3 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Description updated.
      - Vulnerability references updated.

    34218: HTTP: Microsoft Windows EMF Graphic Out-Of-Bounds Read Vulnerability (ZDI-19-704)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "34218: HTTP: Microsoft Windows EMF Graphic Out-Of-Bounds Read Vulnerability".
      - Description updated.
      - Vulnerability references updated.

    * 34221: HTTP: Microsoft Windows Subsetting Library Integer Underflow Vulnerability (ZDI-19-461, ZDI-19-705)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "34221: HTTP: Microsoft Windows Subsetting Library Integer Underflow Vulnerability".
      - Description updated.
      - Vulnerability references updated.

    34223: HTTP: Microsoft Windows Font Subsetting Library Double Free Vulnerability (ZDI-19-707)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "34223: HTTP: Microsoft Windows Font Subsetting Library Double Free Vulnerability".
      - Description updated.
      - Vulnerability references updated.

    34224: HTTP: Microsoft Windows Font Subsetting Library Use-After-Free Vulnerability (ZDI-19-708)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "34224: HTTP: Microsoft Windows Font Subsetting Library Use-After-Free Vulnerability".
      - Description updated.
      - Vulnerability references updated.

    35286: HTTP: Microsoft JET Database Engine Out-Of-Bounds Write Vulnerability (ZDI-19-702)
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Name changed from "35286: HTTP: Microsoft JET Database Engine Out-Of-Bounds Write Vulnerability".
      - Description updated.
      - Vulnerability references updated.

  Removed Filters:

    34562: DHCP: Microsoft Windows DHCP Client Memory Corruption Vulnerability
      - IPS Version: 3.6.2 and after.
      - NGFW Version: 1.0.0 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      

Top of the Page
Premium
Internal
Rating:
Category:
Configure; Troubleshoot; Deploy
Solution Id:
TP000146093
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.