Deep Security Center
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
Asterisk Server IAX2
1003778* - Digium Asterisk IAX2 Call Number Denial Of Service
DCERPC Services
1000972* - Microsoft Windows svcctl ChangeServiceConfig2A() Memory Corruption Vulnerability
1005293* - Prevent Windows Administrator User Login Over SMB
DCERPC Services - Client
1006784* - Identified Windows Group Policy Files Downloaded From Untrusted Sources
Directory Server LDAP
1000086* - CommuniGate Systems CommuniGate Pro LDAP Server Buffer Overflow
FTP Server Common
1000914* - FTP Argument Check
Mail Server Microsoft Exchange
1002632* - Microsoft Outlook Web Access For Exchange Server HTML Validating Cross Site Scripting
Oracle Internet Directory
1003917* - Oracle Internet Directory 'oidldapd' Remote Memory Corruption Vulnerability
TFTP Server
1000929* - 3CDaemon Reserved Device Name DoS
1000876* - Microsoft Windows Remote Installation Service Anonymous File Upload
Unix CVS
1000511* - CVS Annotate Command Long Revision String Buffer Overflow
1000515* - CVS Max-dotdot Command Integer Overflow
Unix Samba SWAT
1000525* - Samba SWAT HTTP Authentication Buffer Overflow
Unix Subversion
1000519* - Subversion svn Protocol String Parsing Vulnerability
Web Application PHP Based
1005664* - PHP 'ip2long' Function String Validation Weakness Vulnerability
Web Application Tomcat
1003954* - Apache Tomcat Directory Traversal Weakness
1003094* - Identified runtime.getRuntime().exec() In HTTP Request
Web Client Common
1008891 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB18-02) - 1
1008883 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB18-02) - 2
1008886 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB18-02) - 3
1008889 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB18-02) - 4
1008885 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB18-02) - 5
1004010* - FFmpeg Version Multiple Remote Vulnerabilities
1004308* - Identified PIF File Over HTTP
1005290* - Identified Suspicious JavaScript iframe Object
1004301* - Microsoft Office Outlook Web Access For Exchange Server 2003 XSRF Vulnerability
1004760* - Restrict Web Client Telnet And Remote Login Handlers
Web Client Internet Explorer/Edge
1005190* - Identified GE Proficy Historian KeyHelp ActiveX Control With LaunchTriPane Function
1001250* - Microsoft Internet Explorer HP Compaq Notebooks ActiveX Remote Code Execution
1004832* - Oracle DataDirect Multiple Native Wire Protocol ODBC Drivers HOST Attribute Stack Based Buffer Overflow Vulnerability
Web Server Apache
1004668* - Apache APR 'apr_fnmatch()' Denial Of Service Vulnerability
1004655* - Apache mod_perl 'path_info' Denial Of Service
Web Server HTTPS
1004351* - Detected Malicious HTTP Requests
Web Server IIS
1003508* - Microsoft IIS Unicode Requests To WebDAV Authentication Bypass Vulnerability
Web Server Miscellaneous
1008751* - Apache CouchDB Remote Code Execution Vulnerabilities (CVE-2017-12635)
1008794* - Apache Struts2 Jackson JSON Library Deserializer Remote Code Execution Vulnerability (CVE-2017-7525)
1008843 - FasterXML Jackson JSON Library Deserializer Multiple Remote Code Execution Vulnerabilities
Web Server Squid
1000388* - Restrict Squid Cache Manager Access
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
Deep Packet Inspection Rules:
Asterisk Server IAX2
1003778* - Digium Asterisk IAX2 Call Number Denial Of Service
DCERPC Services
1000972* - Microsoft Windows svcctl ChangeServiceConfig2A() Memory Corruption Vulnerability
1005293* - Prevent Windows Administrator User Login Over SMB
DCERPC Services - Client
1006784* - Identified Windows Group Policy Files Downloaded From Untrusted Sources
Directory Server LDAP
1000086* - CommuniGate Systems CommuniGate Pro LDAP Server Buffer Overflow
FTP Server Common
1000914* - FTP Argument Check
Mail Server Microsoft Exchange
1002632* - Microsoft Outlook Web Access For Exchange Server HTML Validating Cross Site Scripting
Oracle Internet Directory
1003917* - Oracle Internet Directory 'oidldapd' Remote Memory Corruption Vulnerability
TFTP Server
1000929* - 3CDaemon Reserved Device Name DoS
1000876* - Microsoft Windows Remote Installation Service Anonymous File Upload
Unix CVS
1000511* - CVS Annotate Command Long Revision String Buffer Overflow
1000515* - CVS Max-dotdot Command Integer Overflow
Unix Samba SWAT
1000525* - Samba SWAT HTTP Authentication Buffer Overflow
Unix Subversion
1000519* - Subversion svn Protocol String Parsing Vulnerability
Web Application PHP Based
1005664* - PHP 'ip2long' Function String Validation Weakness Vulnerability
Web Application Tomcat
1003954* - Apache Tomcat Directory Traversal Weakness
1003094* - Identified runtime.getRuntime().exec() In HTTP Request
Web Client Common
1008891 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB18-02) - 1
1008883 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB18-02) - 2
1008886 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB18-02) - 3
1008889 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB18-02) - 4
1008885 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB18-02) - 5
1004010* - FFmpeg Version Multiple Remote Vulnerabilities
1004308* - Identified PIF File Over HTTP
1005290* - Identified Suspicious JavaScript iframe Object
1004301* - Microsoft Office Outlook Web Access For Exchange Server 2003 XSRF Vulnerability
1004760* - Restrict Web Client Telnet And Remote Login Handlers
Web Client Internet Explorer/Edge
1005190* - Identified GE Proficy Historian KeyHelp ActiveX Control With LaunchTriPane Function
1001250* - Microsoft Internet Explorer HP Compaq Notebooks ActiveX Remote Code Execution
1004832* - Oracle DataDirect Multiple Native Wire Protocol ODBC Drivers HOST Attribute Stack Based Buffer Overflow Vulnerability
Web Server Apache
1004668* - Apache APR 'apr_fnmatch()' Denial Of Service Vulnerability
1004655* - Apache mod_perl 'path_info' Denial Of Service
Web Server HTTPS
1004351* - Detected Malicious HTTP Requests
Web Server IIS
1003508* - Microsoft IIS Unicode Requests To WebDAV Authentication Bypass Vulnerability
Web Server Miscellaneous
1008751* - Apache CouchDB Remote Code Execution Vulnerabilities (CVE-2017-12635)
1008794* - Apache Struts2 Jackson JSON Library Deserializer Remote Code Execution Vulnerability (CVE-2017-7525)
1008843 - FasterXML Jackson JSON Library Deserializer Multiple Remote Code Execution Vulnerabilities
Web Server Squid
1000388* - Restrict Squid Cache Manager Access
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
DCERPC Services
1004808* - Identified Big-Endian Byte Order
1008560* - Microsoft Windows Search Remote Code Execution Vulnerability (CVE-2017-8620)
DCERPC Services - Client
1004293* - Identified Microsoft Windows Shortcut File Over Network Share
Database Microsoft SQL
1000917* - Restrict Microsoft SQL Server XP_CMDSHELL Procedure
Directory Server LDAP
1005455* - Microsoft Active Directory Memory Consumption Vulnerability (CVE-2013-1282)
HP Intelligent Management Center (IMC)
1008764* - HPE Intelligent Management Center Directory Traversal Vulnerabilities
Microsoft Office
1004283* - Identified Suspicious Usage Of ACCWIZ.dll ActiveX Control In Microsoft Office Documents
1008872 - Microsoft Office Remote Code Execution Vulnerability (CVE-2018-0841)
1005014* - Restrict Microsoft Office File With Embedded EMF
1005019* - Restrict Microsoft Office File With Linked SWF
NFS Server
1008802* - Linux Kernel NFSv4 nfsd PNFS Denial Of Service Vulnerability (CVE-2017-8797)
Oracle Internet Directory
1002652* - Oracle Internet Directory Remote Preauthentication DoS
1003938* - Oracle Internet Directory oidldapd 'gslsbnrNormalizeString' DoS
TFTP Server
1000928* - AT-TFTP Server Long Filename Buffer Overflow
Unix CFEngine
1000451* - CFEngine CFServD Transaction Packet Buffer Overrun Vulnerability
Unix dtspcd
1000433* - Multiple Vendor CDE dtspcd Buffer Overflow Vulnerability
Web Application Tomcat
1006107* - Apache Tomcat Chunk Request Remote Denial Of Service Vulnerability
1001074* - Apache Tomcat Cookie Handling Session ID Disclosure
Web Client Common
1008854* - Adobe Flash Player Remote Code Execution Vulnerability (CVE-2018-4878)
1008878 - Adobe Flash Player Use After Free Remote Code Execution Vulnerability (CVE-2018-4877)
1003746* - IBM Installation Manager IIM URI Handling Code Execution
1002443* - IBM Lotus Expeditor URI Handler Command Execution Vulnerability
1003479* - IceWarp Merak Web Mail Server 'cleanHTML()' Function Cross-Site Scripting Vulnerability
1002144* - JavaScript IFRAME Redirect Script Insertion Vulnerability
1002048* - JavaScript Redirect Script Insertion Vulnerability
1004649* - Microsoft Compiled HTML Help File Stack Overflow Vulnerability
1008877 - Microsoft Windows Multiple Security Vulnerabilities (Feb-2018)
1008866 - Microsoft Windows StructuredQuery Remote Code Execution Vulnerability (CVE-2018-0825)
Web Client Internet Explorer/Edge
1002964* - Cumulative Security Update of ActiveX Kill Bits - October 2008
1004020* - Domino Web Access ActiveX Control Unspecified Buffer Overflow Vulnerability
1004297* - Microsoft Clip Organizer Multiple Insecure ActiveX Control Vulnerability
1008867 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0834)
1008868 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0835)
1008869 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0837)
1008870 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0838)
1008873 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0858)
1008874 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0860)
1008871 - Microsoft Internet Explorer And Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0840)
1008881 - Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2018-0866)
1005192* - Restrict Cisco AnyConnect Secure Mobility Client ActiveX Controls
1004098* - Restrict Windows Media Player ActiveX Control
Web Client Mozilla Firefox
1003580* - Mozilla Firefox Location Bar Spoofing Vulnerability
1003323* - Mozilla Firefox XBL Script Injection
Web Client SSL
1006296* - Detected SSLv3 Response
1006298* - Identified CBC Based Cipher Suite In SSLv3 Request
Web Server Apache
1000640* - Apache Geronimo Web Access log Viewer Scripts Insertion
Web Server IIS
1005076* - Detected Microsoft Windows Short File/Dir Names Over HTTP
1004887* - Microsoft .NET Framework Forms Authentication URI Spoofing Vulnerability (CVE-2011-3415)
1005622* - Microsoft Internet Information Services DOS Device Request Security Bypass Vulnerability
Web Server Miscellaneous
1008747* - Adobe ColdFusion RMI Registry Insecure Deserialization (CVE-2017-11284)
1008840 - Apache CouchDB '_config' Command Execution Vulnerability (CVE-2017-12636)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
1008852 - Auditd
1004057* - Microsoft Windows Security Events - 1
1008670* - Microsoft Windows Security Events - 3
Deep Packet Inspection Rules:
DCERPC Services
1004808* - Identified Big-Endian Byte Order
1008560* - Microsoft Windows Search Remote Code Execution Vulnerability (CVE-2017-8620)
DCERPC Services - Client
1004293* - Identified Microsoft Windows Shortcut File Over Network Share
Database Microsoft SQL
1000917* - Restrict Microsoft SQL Server XP_CMDSHELL Procedure
Directory Server LDAP
1005455* - Microsoft Active Directory Memory Consumption Vulnerability (CVE-2013-1282)
HP Intelligent Management Center (IMC)
1008764* - HPE Intelligent Management Center Directory Traversal Vulnerabilities
Microsoft Office
1004283* - Identified Suspicious Usage Of ACCWIZ.dll ActiveX Control In Microsoft Office Documents
1008872 - Microsoft Office Remote Code Execution Vulnerability (CVE-2018-0841)
1005014* - Restrict Microsoft Office File With Embedded EMF
1005019* - Restrict Microsoft Office File With Linked SWF
NFS Server
1008802* - Linux Kernel NFSv4 nfsd PNFS Denial Of Service Vulnerability (CVE-2017-8797)
Oracle Internet Directory
1002652* - Oracle Internet Directory Remote Preauthentication DoS
1003938* - Oracle Internet Directory oidldapd 'gslsbnrNormalizeString' DoS
TFTP Server
1000928* - AT-TFTP Server Long Filename Buffer Overflow
Unix CFEngine
1000451* - CFEngine CFServD Transaction Packet Buffer Overrun Vulnerability
Unix dtspcd
1000433* - Multiple Vendor CDE dtspcd Buffer Overflow Vulnerability
Web Application Tomcat
1006107* - Apache Tomcat Chunk Request Remote Denial Of Service Vulnerability
1001074* - Apache Tomcat Cookie Handling Session ID Disclosure
Web Client Common
1008854* - Adobe Flash Player Remote Code Execution Vulnerability (CVE-2018-4878)
1008878 - Adobe Flash Player Use After Free Remote Code Execution Vulnerability (CVE-2018-4877)
1003746* - IBM Installation Manager IIM URI Handling Code Execution
1002443* - IBM Lotus Expeditor URI Handler Command Execution Vulnerability
1003479* - IceWarp Merak Web Mail Server 'cleanHTML()' Function Cross-Site Scripting Vulnerability
1002144* - JavaScript IFRAME Redirect Script Insertion Vulnerability
1002048* - JavaScript Redirect Script Insertion Vulnerability
1004649* - Microsoft Compiled HTML Help File Stack Overflow Vulnerability
1008877 - Microsoft Windows Multiple Security Vulnerabilities (Feb-2018)
1008866 - Microsoft Windows StructuredQuery Remote Code Execution Vulnerability (CVE-2018-0825)
Web Client Internet Explorer/Edge
1002964* - Cumulative Security Update of ActiveX Kill Bits - October 2008
1004020* - Domino Web Access ActiveX Control Unspecified Buffer Overflow Vulnerability
1004297* - Microsoft Clip Organizer Multiple Insecure ActiveX Control Vulnerability
1008867 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0834)
1008868 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0835)
1008869 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0837)
1008870 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0838)
1008873 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0858)
1008874 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0860)
1008871 - Microsoft Internet Explorer And Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0840)
1008881 - Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2018-0866)
1005192* - Restrict Cisco AnyConnect Secure Mobility Client ActiveX Controls
1004098* - Restrict Windows Media Player ActiveX Control
Web Client Mozilla Firefox
1003580* - Mozilla Firefox Location Bar Spoofing Vulnerability
1003323* - Mozilla Firefox XBL Script Injection
Web Client SSL
1006296* - Detected SSLv3 Response
1006298* - Identified CBC Based Cipher Suite In SSLv3 Request
Web Server Apache
1000640* - Apache Geronimo Web Access log Viewer Scripts Insertion
Web Server IIS
1005076* - Detected Microsoft Windows Short File/Dir Names Over HTTP
1004887* - Microsoft .NET Framework Forms Authentication URI Spoofing Vulnerability (CVE-2011-3415)
1005622* - Microsoft Internet Information Services DOS Device Request Security Bypass Vulnerability
Web Server Miscellaneous
1008747* - Adobe ColdFusion RMI Registry Insecure Deserialization (CVE-2017-11284)
1008840 - Apache CouchDB '_config' Command Execution Vulnerability (CVE-2017-12636)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
1008852 - Auditd
1004057* - Microsoft Windows Security Events - 1
1008670* - Microsoft Windows Security Events - 3
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
DCERPC Services
1003984* - SMB NTLM Authentication Lack Of Entropy Vulnerability
DCERPC Services - Client
1008577 - Microsoft Visio OLE DLL Loading Arbitrary Code Execution Vulnerability Over Network Share (CVE-2016-3235)
Database MySQL
1004901* - Identified Suspicious Remote Login To MySQL Server Without Password
HP Intelligent Management Center (IMC)
1008764 - HPE Intelligent Management Center Directory Traversal Vulnerabilities
Trend Micro OfficeScan
1001050* - Trend Micro OfficeScan Server CGI Module Authentication Bypass
Web Application PHP Based
1008858 - Identified Access To 'wp-admin' Directory
1005725* - PHP 'phar_parse_tarfile' Function Integer Overflow
1005915* - phpLDAPadmin 'query_engine' Remote PHP Code Injection Vulnerability
1005947* - phpMyAdmin 'setup.php' PHP Code Injection Vulnerability
Web Application Tomcat
1001108* - Apache Tomcat Cookie Handling Single Quotes Vulnerability
Web Client Common
1008854* - Adobe Flash Player Remote Code Execution Vulnerability (CVE-2018-4878)
1008133* - Cisco WebEx Plugin Magic URL Arbitrary Remote Command Execution Vulnerability
1004596* - Detected Night Dragon Network Communication
1005001* - Disallow Packed Executable Download Over HTTP
1003834* - FFmpeg 'lavf_demux' Animated GIF Processing Remote Denial Of Service Vulnerability
1005269* - Identified Download Of DLL File Over WebDAV
1004242* - Media Player Classic '.mpcpl' File Remote Denial Of Service Vulnerability
1008573 - Microsoft Visio OLE DLL Loading Arbitrary Code Execution Vulnerability Over WebDAV (CVE-2016-3235)
1008838 - Microsoft Windows ITS Protocol Information Disclosure Vulnerability (CVE-2017-11927)
1004665* - Multiple Browser "res://mshtml.dll" Remote Code Execution
1008457* - Ransomware Erebus
1005395* - Restrict Serialized Java Applet
1002519* - Storm Botnet Redirect Script Insertion Vulnerability
Web Client Internet Explorer/Edge
1004021* - IE DHTML Object Memory Corruption Vulnerability
1005301* - Identified Suspicious JavaScript Encoded Window Location Object
1003931* - Microsoft Windows Script Host wshom.ocx ActiveX RegWrite Code Execution
1004626* - Restrict Cisco Secure Desktop ActiveX Control
1004743* - Restrict Citrix Access Gateway ActiveX Control
1005822* - Restrict IBM iNotes UploadControl ActiveX Controls
1005152* - Restrict Microsoft Windows TabStrip ActiveX Control
Web Client Mozilla Firefox
1004371* - Mozilla Firefox Obfuscated URLs Within Iframes Vulnerability
Web Server Common
1005013* - Restrict Microsoft .Net Executable File Upload
Web Server Miscellaneous
1005221* - Identified Suspicious Novell ZENworks Asset Management rtrlet Component Authentication Bypass
1004874* - TimThumb Plugin Remote Code Execution Vulnerability
Web Server Oracle
1003439* - Oracle Application Server 10g OPMN Service Format String Vulnerability
Web Service HP SiteScope
1005837* - HP SiteScope "issueSiebelCmd" SOAP Request Detected
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
Deep Packet Inspection Rules:
DCERPC Services
1003984* - SMB NTLM Authentication Lack Of Entropy Vulnerability
DCERPC Services - Client
1008577 - Microsoft Visio OLE DLL Loading Arbitrary Code Execution Vulnerability Over Network Share (CVE-2016-3235)
Database MySQL
1004901* - Identified Suspicious Remote Login To MySQL Server Without Password
HP Intelligent Management Center (IMC)
1008764 - HPE Intelligent Management Center Directory Traversal Vulnerabilities
Trend Micro OfficeScan
1001050* - Trend Micro OfficeScan Server CGI Module Authentication Bypass
Web Application PHP Based
1008858 - Identified Access To 'wp-admin' Directory
1005725* - PHP 'phar_parse_tarfile' Function Integer Overflow
1005915* - phpLDAPadmin 'query_engine' Remote PHP Code Injection Vulnerability
1005947* - phpMyAdmin 'setup.php' PHP Code Injection Vulnerability
Web Application Tomcat
1001108* - Apache Tomcat Cookie Handling Single Quotes Vulnerability
Web Client Common
1008854* - Adobe Flash Player Remote Code Execution Vulnerability (CVE-2018-4878)
1008133* - Cisco WebEx Plugin Magic URL Arbitrary Remote Command Execution Vulnerability
1004596* - Detected Night Dragon Network Communication
1005001* - Disallow Packed Executable Download Over HTTP
1003834* - FFmpeg 'lavf_demux' Animated GIF Processing Remote Denial Of Service Vulnerability
1005269* - Identified Download Of DLL File Over WebDAV
1004242* - Media Player Classic '.mpcpl' File Remote Denial Of Service Vulnerability
1008573 - Microsoft Visio OLE DLL Loading Arbitrary Code Execution Vulnerability Over WebDAV (CVE-2016-3235)
1008838 - Microsoft Windows ITS Protocol Information Disclosure Vulnerability (CVE-2017-11927)
1004665* - Multiple Browser "res://mshtml.dll" Remote Code Execution
1008457* - Ransomware Erebus
1005395* - Restrict Serialized Java Applet
1002519* - Storm Botnet Redirect Script Insertion Vulnerability
Web Client Internet Explorer/Edge
1004021* - IE DHTML Object Memory Corruption Vulnerability
1005301* - Identified Suspicious JavaScript Encoded Window Location Object
1003931* - Microsoft Windows Script Host wshom.ocx ActiveX RegWrite Code Execution
1004626* - Restrict Cisco Secure Desktop ActiveX Control
1004743* - Restrict Citrix Access Gateway ActiveX Control
1005822* - Restrict IBM iNotes UploadControl ActiveX Controls
1005152* - Restrict Microsoft Windows TabStrip ActiveX Control
Web Client Mozilla Firefox
1004371* - Mozilla Firefox Obfuscated URLs Within Iframes Vulnerability
Web Server Common
1005013* - Restrict Microsoft .Net Executable File Upload
Web Server Miscellaneous
1005221* - Identified Suspicious Novell ZENworks Asset Management rtrlet Component Authentication Bypass
1004874* - TimThumb Plugin Remote Code Execution Vulnerability
Web Server Oracle
1003439* - Oracle Application Server 10g OPMN Service Format String Vulnerability
Web Service HP SiteScope
1005837* - HP SiteScope "issueSiebelCmd" SOAP Request Detected
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
Web Client Common
1008854 - Adobe Flash Player Remote Code Execution Vulnerability (CVE-2018-4878)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
Deep Packet Inspection Rules:
Web Client Common
1008854 - Adobe Flash Player Remote Code Execution Vulnerability (CVE-2018-4878)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
Arcserve Unified Data Protection
1008711* - Arcserve Unified Data Protection Management Service Information Disclosure Vulnerability (CVE-2015-4069)
DCERPC Services
1008380* - Microsoft Windows Group Policy Preferences Password Elevation Of Privilege Vulnerability (CVE-2014-1812)
1008713* - Microsoft Windows SMB Server SMBv1 Information Disclosure Vulnerability (CVE-2017-11815)
1008560* - Microsoft Windows Search Remote Code Execution Vulnerability (CVE-2017-8620)
Database Microsoft SQL
1008559* - Microsoft SQL Server Buffer Overflow Vulnerability (CVE-2008-0106)
Directory Server LDAP
1008459* - Samba NDR Parsing Remote Code Execution Vulnerability (CVE-2016-2123)
HP Intelligent Management Center (IMC)
1008806* - HPE Intelligent Management Center FileUploadServlet Directory Traversal Vulnerability (CVE-2017-5794)
1008686* - HPE Operations Orchestration Deserialization Remote Code Execution Vulnerability (CVE-2016-8519)
Mail Server Exim
1008758* - Exim Unix Mailer Multiple Security Vulnerabilities
NFS Server
1008802 - Linux Kernel NFSv4 nfsd PNFS Denial Of Service Vulnerability (CVE-2017-8797)
Network Scanner
1008800 - Bypass Network Scanner Traffic
OpenSSL
1008715* - OpenSSL X.509 IPAddressFamily Extension Parsing Out-Of-Bounds Read Vulnerability (CVE-2017-3735) - Server
Oracle Tuxedo JOLT
1008798* - Oracle Tuxedo Jolt Heap Buffer Overflow Vulnerability (CVE-2017-10278)
1008845* - Oracle Tuxedo Remote Security Vulnerability (CVE-2017-10269)
Symantec Messaging Gateway
1008741* - Symantec Messaging Gateway Remote Code Execution Vulnerability (CVE-2017-6326)
Trend Micro Control Manager
1008760* - Trend Micro Control Manager SQL Injection Vulnerability (CVE-2017-11383)
1008589* - Trend Micro Control Manager cmdHandlerLicenseManager SQL Injection Vulnerability (CVE-2017-11384)
Unix Samba
1008644* - Samba Arbitrary File Write Vulnerability (CVE-2017-12163)
Web Server Common
1008724* - Trend Micro SafeSync For Enterprise 'device_id' 'role' Command Injection Vulnerability
1008723* - Trend Micro SafeSync For Enterprise Command Injection Vulnerability
Web Server Miscellaneous
1008747 - Adobe ColdFusion RMI Registry Insecure Deserialization (CVE-2017-11284)
1008673* - IBM Informix Open Admin Tool Heap Buffer Overflow Vulnerability (CVE-2017-1092)
1008674* - IBM Informix Open Admin Tool Remote Code Execution Vulnerability (CVE-2017-1092)
Web Server Oracle
1008808* - Oracle WebLogic WLS Security Component Remote Code Execution Vulnerabilities
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
1002828* - Application - Secure Shell Daemon (SSHD)
Deep Packet Inspection Rules:
Arcserve Unified Data Protection
1008711* - Arcserve Unified Data Protection Management Service Information Disclosure Vulnerability (CVE-2015-4069)
DCERPC Services
1008380* - Microsoft Windows Group Policy Preferences Password Elevation Of Privilege Vulnerability (CVE-2014-1812)
1008713* - Microsoft Windows SMB Server SMBv1 Information Disclosure Vulnerability (CVE-2017-11815)
1008560* - Microsoft Windows Search Remote Code Execution Vulnerability (CVE-2017-8620)
Database Microsoft SQL
1008559* - Microsoft SQL Server Buffer Overflow Vulnerability (CVE-2008-0106)
Directory Server LDAP
1008459* - Samba NDR Parsing Remote Code Execution Vulnerability (CVE-2016-2123)
HP Intelligent Management Center (IMC)
1008806* - HPE Intelligent Management Center FileUploadServlet Directory Traversal Vulnerability (CVE-2017-5794)
1008686* - HPE Operations Orchestration Deserialization Remote Code Execution Vulnerability (CVE-2016-8519)
Mail Server Exim
1008758* - Exim Unix Mailer Multiple Security Vulnerabilities
NFS Server
1008802 - Linux Kernel NFSv4 nfsd PNFS Denial Of Service Vulnerability (CVE-2017-8797)
Network Scanner
1008800 - Bypass Network Scanner Traffic
OpenSSL
1008715* - OpenSSL X.509 IPAddressFamily Extension Parsing Out-Of-Bounds Read Vulnerability (CVE-2017-3735) - Server
Oracle Tuxedo JOLT
1008798* - Oracle Tuxedo Jolt Heap Buffer Overflow Vulnerability (CVE-2017-10278)
1008845* - Oracle Tuxedo Remote Security Vulnerability (CVE-2017-10269)
Symantec Messaging Gateway
1008741* - Symantec Messaging Gateway Remote Code Execution Vulnerability (CVE-2017-6326)
Trend Micro Control Manager
1008760* - Trend Micro Control Manager SQL Injection Vulnerability (CVE-2017-11383)
1008589* - Trend Micro Control Manager cmdHandlerLicenseManager SQL Injection Vulnerability (CVE-2017-11384)
Unix Samba
1008644* - Samba Arbitrary File Write Vulnerability (CVE-2017-12163)
Web Server Common
1008724* - Trend Micro SafeSync For Enterprise 'device_id' 'role' Command Injection Vulnerability
1008723* - Trend Micro SafeSync For Enterprise Command Injection Vulnerability
Web Server Miscellaneous
1008747 - Adobe ColdFusion RMI Registry Insecure Deserialization (CVE-2017-11284)
1008673* - IBM Informix Open Admin Tool Heap Buffer Overflow Vulnerability (CVE-2017-1092)
1008674* - IBM Informix Open Admin Tool Remote Code Execution Vulnerability (CVE-2017-1092)
Web Server Oracle
1008808* - Oracle WebLogic WLS Security Component Remote Code Execution Vulnerabilities
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
1002828* - Application - Secure Shell Daemon (SSHD)
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
DCERPC Services
1003292* - Block Conficker.B++ Worm Incoming Named Pipe Connection
1004807* - Identified SMB Raw Named Pipe In Write Mode
DCERPC Services - Client
1007494* - Adobe Acrobat DLL Loading Arbitrary Code Execution Vulnerability (CVE-2016-1008)
1003293* - Block Conficker.B++ Worm Outgoing Named Pipe Connection
1004373* - Identified Microsoft DLL File Over Network Share
1007426* - Microsoft Windows DLL Loading Vulnerabilities Over Network Share (MS16-014)
Database MySQL
1005063* - Restrict MySQL Database Access
Database Oracle
1004995* - Oracle Database TNS Listener Poison Attack Vulnerability
FTP Server Common
1003784* - FTP Server Restrict Executable File Uploads
1005461* - Identified FTP Connection Without AUTH Command
HP Intelligent Management Center (IMC)
1008806 - HPE Intelligent Management Center FileUploadServlet Directory Traversal Vulnerability (CVE-2017-5794)
HP Intelligent Management Center Dbman
1008790 - HPE Intelligent Management Center dbman Opcode 10012 Use-After-Free Remote Code Execution Vulnerability (CVE-2017-12561)
Mail Server Exim
1008758* - Exim Unix Mailer Multiple Security Vulnerabilities
Microsoft Office
1004853* - Identified Suspicious Microsoft Office Files With Embedded Font
1005615* - Identified Suspicious Usage Of Shellcode In Microsoft Office Files
1004647* - Restrict Microsoft Office File With Embedded SWF
1005158* - Restrict Microsoft Office Files With Embedded SWF - 2
Novell File Reporter (NFR) Agent
1005260* - Novell File Reporter SRS XML Server Request With Path Element Detected
Oracle Tuxedo JOLT
1008845 - Oracle Tuxedo Remote Security Vulnerability (CVE-2017-10269)
Suspicious Client Application Activity
1005067* - Identified Potentially Harmful Client Traffic
1005283* - Identified Potentially Malicious RAT Traffic - I
1005299* - Identified Potentially Malicious RAT Traffic - III
1005300* - Identified Potentially Malicious RAT Traffic - IV
1005473* - Identified Potentially Malicious RAT Traffic - V
Suspicious Server Application Activity
1005090* - Identified Potentially Harmful Server Traffic
Unix SSH
1000798* - Unix OpenSSH sshd Identical Blocks DoS
Web Application Common
1004888* - Restrict Number Of Parameters In HTTP Request
Web Application PHP Based
1005465* - Identified Access To WordPress Sensitive Files
1006021* - Joomla JCE Extension Multiple Vulnerabilities
1000208* - SquirrelMail IMAP Command Injection Vulnerability
1000209* - SquirrelMail SMTP Command Injection Vulnerability
1006432* - WordPress Slider Revolution Responsive/Showbiz Pro Responsive Teaser Multiple Security Bypass Vulnerabilities
Web Client Common
1008833 - Foxit Reader JPEG2000 Out-Of-Bounds Read Information Disclosure Vulnerabilities
1005389* - Identified Suspicious Download Of Executable File Over HTTP
1004900* - Identified Suspicious Microsoft Office Files With Embedded Objects
Web Client Internet Explorer/Edge
1004339* - Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability
Web Server Common
1008724* - Trend Micro SafeSync For Enterprise 'device_id' 'role' Command Injection Vulnerability
1008723* - Trend Micro SafeSync For Enterprise Command Injection Vulnerability
Web Server Miscellaneous
1008673 - IBM Informix Open Admin Tool Heap Buffer Overflow Vulnerability (CVE-2017-1092)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
Deep Packet Inspection Rules:
DCERPC Services
1003292* - Block Conficker.B++ Worm Incoming Named Pipe Connection
1004807* - Identified SMB Raw Named Pipe In Write Mode
DCERPC Services - Client
1007494* - Adobe Acrobat DLL Loading Arbitrary Code Execution Vulnerability (CVE-2016-1008)
1003293* - Block Conficker.B++ Worm Outgoing Named Pipe Connection
1004373* - Identified Microsoft DLL File Over Network Share
1007426* - Microsoft Windows DLL Loading Vulnerabilities Over Network Share (MS16-014)
Database MySQL
1005063* - Restrict MySQL Database Access
Database Oracle
1004995* - Oracle Database TNS Listener Poison Attack Vulnerability
FTP Server Common
1003784* - FTP Server Restrict Executable File Uploads
1005461* - Identified FTP Connection Without AUTH Command
HP Intelligent Management Center (IMC)
1008806 - HPE Intelligent Management Center FileUploadServlet Directory Traversal Vulnerability (CVE-2017-5794)
HP Intelligent Management Center Dbman
1008790 - HPE Intelligent Management Center dbman Opcode 10012 Use-After-Free Remote Code Execution Vulnerability (CVE-2017-12561)
Mail Server Exim
1008758* - Exim Unix Mailer Multiple Security Vulnerabilities
Microsoft Office
1004853* - Identified Suspicious Microsoft Office Files With Embedded Font
1005615* - Identified Suspicious Usage Of Shellcode In Microsoft Office Files
1004647* - Restrict Microsoft Office File With Embedded SWF
1005158* - Restrict Microsoft Office Files With Embedded SWF - 2
Novell File Reporter (NFR) Agent
1005260* - Novell File Reporter SRS XML Server Request With Path Element Detected
Oracle Tuxedo JOLT
1008845 - Oracle Tuxedo Remote Security Vulnerability (CVE-2017-10269)
Suspicious Client Application Activity
1005067* - Identified Potentially Harmful Client Traffic
1005283* - Identified Potentially Malicious RAT Traffic - I
1005299* - Identified Potentially Malicious RAT Traffic - III
1005300* - Identified Potentially Malicious RAT Traffic - IV
1005473* - Identified Potentially Malicious RAT Traffic - V
Suspicious Server Application Activity
1005090* - Identified Potentially Harmful Server Traffic
Unix SSH
1000798* - Unix OpenSSH sshd Identical Blocks DoS
Web Application Common
1004888* - Restrict Number Of Parameters In HTTP Request
Web Application PHP Based
1005465* - Identified Access To WordPress Sensitive Files
1006021* - Joomla JCE Extension Multiple Vulnerabilities
1000208* - SquirrelMail IMAP Command Injection Vulnerability
1000209* - SquirrelMail SMTP Command Injection Vulnerability
1006432* - WordPress Slider Revolution Responsive/Showbiz Pro Responsive Teaser Multiple Security Bypass Vulnerabilities
Web Client Common
1008833 - Foxit Reader JPEG2000 Out-Of-Bounds Read Information Disclosure Vulnerabilities
1005389* - Identified Suspicious Download Of Executable File Over HTTP
1004900* - Identified Suspicious Microsoft Office Files With Embedded Objects
Web Client Internet Explorer/Edge
1004339* - Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability
Web Server Common
1008724* - Trend Micro SafeSync For Enterprise 'device_id' 'role' Command Injection Vulnerability
1008723* - Trend Micro SafeSync For Enterprise Command Injection Vulnerability
Web Server Miscellaneous
1008673 - IBM Informix Open Admin Tool Heap Buffer Overflow Vulnerability (CVE-2017-1092)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
Arcserve Unified Data Protection
1008711 - Arcserve Unified Data Protection Management Service Information Disclosure Vulnerability (CVE-2015-4069)
DCERPC Services
1008327* - Identified Server Suspicious SMB Session
1008558* - Identified Windows Search Protocol Network Traffic Over SMB
1008380 - Microsoft Windows Group Policy Preferences Password Elevation Of Privilege Vulnerability (CVE-2014-1812)
1008225* - Microsoft Windows SMB Remote Code Execution Vulnerability (CVE-2017-0145)
1008713 - Microsoft Windows SMB Server SMBv1 Information Disclosure Vulnerability (CVE-2017-11815)
1008560* - Microsoft Windows Search Remote Code Execution Vulnerability (CVE-2017-8620)
1000735* - Microsoft Windows Server Service Remote Code Execution
DCERPC Services - Client
1007592* - Microsoft Windows DLL Loading Vulnerabilities Over Network Share (CVE-2016-0160 and CVE-2016-0148)
Database Microsoft SQL
1008559 - Microsoft SQL Server Buffer Overflow Vulnerability (CVE-2008-0106)
Directory Server LDAP
1008459 - Samba NDR Parsing Remote Code Execution Vulnerability (CVE-2016-2123)
HP Intelligent Management Center (IMC)
1008748* - HPE Intelligent Management Center PLAT flexFileUpload Arbitrary File Upload Vulnerability (CVE-2017-8961)
1008686 - HPE Operations Orchestration Deserialization Remote Code Execution Vulnerability (CVE-2016-8519)
Microsoft Office
1008839 - Microsoft Office Memory Corruption Vulnerability (CVE-2018-0802)
NTP Client
1008632* - Identified Zero Origin Timestamp In NTP Traffic
NTP Server Linux
1008320* - Network Time Protocol Daemon 'peer_xmit' Mode Denial Of Service Vulnerability (CVE-2017-6464)
OpenSSL
1008715* - OpenSSL X.509 IPAddressFamily Extension Parsing Out-Of-Bounds Read Vulnerability (CVE-2017-3735) - Server
Oracle Tuxedo JOLT
1008798 - Oracle Tuxedo Jolt Heap Buffer Overflow Vulnerability (CVE-2017-10278)
RADIUS Server
1008614* - FreeRADIUS Heap Buffer Overflow Vulnerability (CVE-2017-10984)
SSL Client
1008714* - OpenSSL X.509 IPAddressFamily Extension Parsing Out-Of-Bounds Read Vulnerability (CVE-2017-3735) - Client
Symantec Messaging Gateway
1008741 - Symantec Messaging Gateway Remote Code Execution Vulnerability (CVE-2017-6326)
Trend Micro Control Manager
1008760 - Trend Micro Control Manager SQL Injection Vulnerability (CVE-2017-11383)
1008589 - Trend Micro Control Manager cmdHandlerLicenseManager SQL Injection Vulnerability (CVE-2017-11384)
Unix RPC Services
1008433* - Solaris Calendar Manager Service Daemon (rpc.cmsd) Remote Code Execution Vulnerability (CVE-2017-3632)
Unix Samba
1008644 - Samba Arbitrary File Write Vulnerability (CVE-2017-12163)
Web Application PHP Based
1008550* - PHP 'imagegammacorrect' Function Arbitrary Write Access vulnerability (CVE-2016-7127)
1008520* - PHP Malicious Object Injection In Deserialization Vulnerability (CVE-2016-7124)
1008562* - PHP libgd Signedness Heap Overflow Vulnerability (CVE-2016-3074)
Web Application Ruby Based
1008574* - Ruby On Rails Development Web Console Code Execution Vulnerability (CVE-2015-3224)
Web Client Common
1008736* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB17-36) - 6
1008738* - Adobe Flash Player Multiple Security Vulnerabilities (APSB17-33)
1008726 - Foxit Reader Multiple Use-After-Free Remote Code Execution Vulnerabilities
1007931* - Microsoft Windows Information Disclosure Vulnerability (CVE-2016-3352)
1008828* - Speculative Execution Information Disclosure Vulnerabilities (Spectre)
Web Client Internet Explorer/Edge
1008836 - Microsoft Edge Scripting Engine Information Disclosure Vulnerability (CVE-2018-0767)
1008704* - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2017-11840)
1008706* - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2017-11873)
1008697* - Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2017-11855)
Web Server Miscellaneous
1008794* - Apache Struts2 Jackson JSON Library Deserializer Remote Code Execution Vulnerability (CVE-2017-7525)
1008207* - Apache Struts2 Remote Code Execution Vulnerability (CVE-2017-5638)
1008674 - IBM Informix Open Admin Tool Remote Code Execution Vulnerability (CVE-2017-1092)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
Deep Packet Inspection Rules:
Arcserve Unified Data Protection
1008711 - Arcserve Unified Data Protection Management Service Information Disclosure Vulnerability (CVE-2015-4069)
DCERPC Services
1008327* - Identified Server Suspicious SMB Session
1008558* - Identified Windows Search Protocol Network Traffic Over SMB
1008380 - Microsoft Windows Group Policy Preferences Password Elevation Of Privilege Vulnerability (CVE-2014-1812)
1008225* - Microsoft Windows SMB Remote Code Execution Vulnerability (CVE-2017-0145)
1008713 - Microsoft Windows SMB Server SMBv1 Information Disclosure Vulnerability (CVE-2017-11815)
1008560* - Microsoft Windows Search Remote Code Execution Vulnerability (CVE-2017-8620)
1000735* - Microsoft Windows Server Service Remote Code Execution
DCERPC Services - Client
1007592* - Microsoft Windows DLL Loading Vulnerabilities Over Network Share (CVE-2016-0160 and CVE-2016-0148)
Database Microsoft SQL
1008559 - Microsoft SQL Server Buffer Overflow Vulnerability (CVE-2008-0106)
Directory Server LDAP
1008459 - Samba NDR Parsing Remote Code Execution Vulnerability (CVE-2016-2123)
HP Intelligent Management Center (IMC)
1008748* - HPE Intelligent Management Center PLAT flexFileUpload Arbitrary File Upload Vulnerability (CVE-2017-8961)
1008686 - HPE Operations Orchestration Deserialization Remote Code Execution Vulnerability (CVE-2016-8519)
Microsoft Office
1008839 - Microsoft Office Memory Corruption Vulnerability (CVE-2018-0802)
NTP Client
1008632* - Identified Zero Origin Timestamp In NTP Traffic
NTP Server Linux
1008320* - Network Time Protocol Daemon 'peer_xmit' Mode Denial Of Service Vulnerability (CVE-2017-6464)
OpenSSL
1008715* - OpenSSL X.509 IPAddressFamily Extension Parsing Out-Of-Bounds Read Vulnerability (CVE-2017-3735) - Server
Oracle Tuxedo JOLT
1008798 - Oracle Tuxedo Jolt Heap Buffer Overflow Vulnerability (CVE-2017-10278)
RADIUS Server
1008614* - FreeRADIUS Heap Buffer Overflow Vulnerability (CVE-2017-10984)
SSL Client
1008714* - OpenSSL X.509 IPAddressFamily Extension Parsing Out-Of-Bounds Read Vulnerability (CVE-2017-3735) - Client
Symantec Messaging Gateway
1008741 - Symantec Messaging Gateway Remote Code Execution Vulnerability (CVE-2017-6326)
Trend Micro Control Manager
1008760 - Trend Micro Control Manager SQL Injection Vulnerability (CVE-2017-11383)
1008589 - Trend Micro Control Manager cmdHandlerLicenseManager SQL Injection Vulnerability (CVE-2017-11384)
Unix RPC Services
1008433* - Solaris Calendar Manager Service Daemon (rpc.cmsd) Remote Code Execution Vulnerability (CVE-2017-3632)
Unix Samba
1008644 - Samba Arbitrary File Write Vulnerability (CVE-2017-12163)
Web Application PHP Based
1008550* - PHP 'imagegammacorrect' Function Arbitrary Write Access vulnerability (CVE-2016-7127)
1008520* - PHP Malicious Object Injection In Deserialization Vulnerability (CVE-2016-7124)
1008562* - PHP libgd Signedness Heap Overflow Vulnerability (CVE-2016-3074)
Web Application Ruby Based
1008574* - Ruby On Rails Development Web Console Code Execution Vulnerability (CVE-2015-3224)
Web Client Common
1008736* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB17-36) - 6
1008738* - Adobe Flash Player Multiple Security Vulnerabilities (APSB17-33)
1008726 - Foxit Reader Multiple Use-After-Free Remote Code Execution Vulnerabilities
1007931* - Microsoft Windows Information Disclosure Vulnerability (CVE-2016-3352)
1008828* - Speculative Execution Information Disclosure Vulnerabilities (Spectre)
Web Client Internet Explorer/Edge
1008836 - Microsoft Edge Scripting Engine Information Disclosure Vulnerability (CVE-2018-0767)
1008704* - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2017-11840)
1008706* - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2017-11873)
1008697* - Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2017-11855)
Web Server Miscellaneous
1008794* - Apache Struts2 Jackson JSON Library Deserializer Remote Code Execution Vulnerability (CVE-2017-7525)
1008207* - Apache Struts2 Remote Code Execution Vulnerability (CVE-2017-5638)
1008674 - IBM Informix Open Admin Tool Remote Code Execution Vulnerability (CVE-2017-1092)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
DCERPC Services
1008717* - Microsoft Windows Search Remote Code Execution Vulnerability (CVE-2017-11771)
DCERPC Services - Client
1007369* - Microsoft Windows DLL Loading Vulnerabilities Over Network Share (MS16-007)
DNS Client
1002657* - Identified Too Many DNS Responses
1008793 - systemd Network Name Resolution Manager NSEC Resource Record Pseudo-Types Denial Of Service Vulnerability (CVE-2017-15908)
Microsoft Office
1008831 - Microsoft Word Memory Corruption Vulnerability (CVE-2018-0797)
Web Application PHP Based
1008518* - PHP Double Free Memory Corruption Vulnerability (CVE-2016-5772)
Web Client Common
1008830 - Adobe Flash Player Memory Corruption Vulnerability (APSB18-01)
Web Server Common
1008724 - Trend Micro SafeSync For Enterprise 'device_id' 'role' Command Injection Vulnerability
1008723 - Trend Micro SafeSync For Enterprise Command Injection Vulnerability
Web Server Miscellaneous
1008794 - Apache Struts2 Jackson JSON Library Deserializer Remote Code Execution Vulnerability (CVE-2017-7525)
Web Server Oracle
1008808* - Oracle WebLogic WLS Security Component Remote Code Execution Vulnerabilities
Integrity Monitoring Rules:
1008720 - Users and Groups - Create and Delete Activity
Log Inspection Rules:
1008619 - Application - Docker
1003843* - Microsoft Windows Security Events
1004057* - Microsoft Windows Security Events - 1
1003987* - Microsoft Windows Security Events - 2
1008670* - Microsoft Windows Security Events - 3
1008792* - Microsoft Windows Security Events - 4
Deep Packet Inspection Rules:
DCERPC Services
1008717* - Microsoft Windows Search Remote Code Execution Vulnerability (CVE-2017-11771)
DCERPC Services - Client
1007369* - Microsoft Windows DLL Loading Vulnerabilities Over Network Share (MS16-007)
DNS Client
1002657* - Identified Too Many DNS Responses
1008793 - systemd Network Name Resolution Manager NSEC Resource Record Pseudo-Types Denial Of Service Vulnerability (CVE-2017-15908)
Microsoft Office
1008831 - Microsoft Word Memory Corruption Vulnerability (CVE-2018-0797)
Web Application PHP Based
1008518* - PHP Double Free Memory Corruption Vulnerability (CVE-2016-5772)
Web Client Common
1008830 - Adobe Flash Player Memory Corruption Vulnerability (APSB18-01)
Web Server Common
1008724 - Trend Micro SafeSync For Enterprise 'device_id' 'role' Command Injection Vulnerability
1008723 - Trend Micro SafeSync For Enterprise Command Injection Vulnerability
Web Server Miscellaneous
1008794 - Apache Struts2 Jackson JSON Library Deserializer Remote Code Execution Vulnerability (CVE-2017-7525)
Web Server Oracle
1008808* - Oracle WebLogic WLS Security Component Remote Code Execution Vulnerabilities
Integrity Monitoring Rules:
1008720 - Users and Groups - Create and Delete Activity
Log Inspection Rules:
1008619 - Application - Docker
1003843* - Microsoft Windows Security Events
1004057* - Microsoft Windows Security Events - 1
1003987* - Microsoft Windows Security Events - 2
1008670* - Microsoft Windows Security Events - 3
1008792* - Microsoft Windows Security Events - 4
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
Web Client Common
1008828 - Speculative Execution Information Disclosure Vulnerabilities (Spectre)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
Deep Packet Inspection Rules:
Web Client Common
1008828 - Speculative Execution Information Disclosure Vulnerabilities (Spectre)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
Web Client Internet Explorer/Edge
1008826 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0758)
1008825 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0769)
1008824 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0773)
1008821 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0774)
1008822 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0775)
1008820 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0776)
1008819 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0777)
1008823 - Microsoft Internet Explorer And Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0762)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
Deep Packet Inspection Rules:
Web Client Internet Explorer/Edge
1008826 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0758)
1008825 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0769)
1008824 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0773)
1008821 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0774)
1008822 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0775)
1008820 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0776)
1008819 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0777)
1008823 - Microsoft Internet Explorer And Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0762)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.