Summary
Digital Vaccine #9450 OOB September 17, 2020
Details
| Thank you for subscribing to Digital Vaccine updates brought to you by Trend Micro™ TippingPoint DVLabs. New content is now available at the Threat Management Center (TMC): https://tmc.tippingpoint.com. Note: This is an out-of-band DV release to address new vectors and intelligence related to CVE-2020-1472 AKA Zerologon. Filter 38166 which addresses this vulnerability will be enabled in the default profile as a part of this update. The regular weekly DV will be published as scheduled on Tuesday, September 22, 2020. SMS customers can update the Digital Vaccine through the SMS client. From the top-line menu, you can open the "File > Download Digital Vaccine from TMC" menu item to detect and load the latest update. |
| System Requirements |
| The 3.2.0 DV will run on IPS devices with TOS v3.2.0 and above, all NGFW and all TPS systems. The 4.0.0 DV will only run on the Virtual Threat Protection System (vTPS) appliance. Please note that vTPS does not currently support pre-disclosed ZDI filters. |
| The Digital Vaccine can be manually downloaded from the following URLs: https://tmc.tippingpoint.com/TMC/ViewPackage?parentFolderId=digital_vaccines&contentId=SIG_3.2.0_9450.pkg https://tmc.tippingpoint.com/TMC/ViewPackage?parentFolderId=vsa_dv&contentId=SIG_VTPS_4.0.0_9450.pkg |
Update Details
Table of Contents
--------------------------
Filters
New Filters - 0
Modified Filters (logic changes) - 1
Modified Filters (metadata changes only) - 0
Removed Filters - 0
Filters
----------------
New Filters: None
Modified Filters (logic changes):
* = Enabled in Default deployments
* 38166: MS-NRPC: Microsoft Windows Netlogon Authentication Bypass Vulnerability
- IPS Version: 3.6.2 and after.
- NGFW Version: 1.0.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Name changed from "38166: MS-NRPC: Microsoft Windows Netlogon Zerologon Authentication Bypass Attempt".
- Description updated.
- Detection logic updated.
- Deployments updated and are now:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- Release Date: September 15, 2020
- Last Modified Date: September 17, 2020
Modified Filters (metadata changes only): None
Removed Filters: None
Top of the Page
