Rule Update
19-030 (May 28, 2019)
DESCRIPTION
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
NTP Server Linux
1009492 - NTPsec 'ntpd ctl_getitem' Out Of Bounds Read Vulnerability (CVE-2019-6443)
1009620 - NTPsec ntpd 'write_variables' Denial Of Service Vulnerability (CVE-2019-6445)
Remote Desktop Protocol Server
1009749* - Microsoft Windows Remote Desktop Services Remote Code Execution Vulnerability (CVE-2019-0708)
Web Client Common
1009666* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB19-17) - 2
1009405* - Adobe Flash Player Use After Free Vulnerability (CVE-2018-15982)
1009518 - Microsoft Office Information Disclosure Vulnerability (CVE-2019-0560)
1009758 - Microsoft Windows Font Subsetting Library Integer Overflow Remote Code Execution Vulnerability (CVE-2019-0903)
1009765 - Microsoft Windows GDI Information Disclosure Vulnerability (CVE-2018-8472)
1009768 - Microsoft Windows GDI Information Disclosure Vulnerability (CVE-2019-0758)
1009759 - Microsoft Windows GDI Information Disclosure Vulnerability (CVE-2019-0961)
1009760 - Microsoft Windows Jet Database Engine Multiple Remote Code Execution Vulnerabilities (May-2019)
1009668 - Oracle Java Arbitrary File Deletion Vulnerability (CVE-2019-2449)
Web Client Internet Explorer/Edge
1009763 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2019-0937)
1009733* - Microsoft Internet Explorer And Edge Scripting Engine Memory Corruption Vulnerability (CVE-2019-0940)
Web Server Oracle Report Server
1006238* - Restrict Oracle Reports Parsequery And Urlparameter Query Access
Web Server SharePoint
1009535* - Microsoft SharePoint Remote Code Execution Vulnerability (CVE-2019-0604)
Zoho ManageEngine
1009470 - Zoho ManageEngine OpManager DataMigrationServlet Insecure Deserialization Vulnerability (CVE-2018-19403)
Integrity Monitoring Rules:
1009639 - Application Shimming (ATT&CK: T1138)
1009672 - Time Providers (ATT&CK: T1209)
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
Deep Packet Inspection Rules:
NTP Server Linux
1009492 - NTPsec 'ntpd ctl_getitem' Out Of Bounds Read Vulnerability (CVE-2019-6443)
1009620 - NTPsec ntpd 'write_variables' Denial Of Service Vulnerability (CVE-2019-6445)
Remote Desktop Protocol Server
1009749* - Microsoft Windows Remote Desktop Services Remote Code Execution Vulnerability (CVE-2019-0708)
Web Client Common
1009666* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB19-17) - 2
1009405* - Adobe Flash Player Use After Free Vulnerability (CVE-2018-15982)
1009518 - Microsoft Office Information Disclosure Vulnerability (CVE-2019-0560)
1009758 - Microsoft Windows Font Subsetting Library Integer Overflow Remote Code Execution Vulnerability (CVE-2019-0903)
1009765 - Microsoft Windows GDI Information Disclosure Vulnerability (CVE-2018-8472)
1009768 - Microsoft Windows GDI Information Disclosure Vulnerability (CVE-2019-0758)
1009759 - Microsoft Windows GDI Information Disclosure Vulnerability (CVE-2019-0961)
1009760 - Microsoft Windows Jet Database Engine Multiple Remote Code Execution Vulnerabilities (May-2019)
1009668 - Oracle Java Arbitrary File Deletion Vulnerability (CVE-2019-2449)
Web Client Internet Explorer/Edge
1009763 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2019-0937)
1009733* - Microsoft Internet Explorer And Edge Scripting Engine Memory Corruption Vulnerability (CVE-2019-0940)
Web Server Oracle Report Server
1006238* - Restrict Oracle Reports Parsequery And Urlparameter Query Access
Web Server SharePoint
1009535* - Microsoft SharePoint Remote Code Execution Vulnerability (CVE-2019-0604)
Zoho ManageEngine
1009470 - Zoho ManageEngine OpManager DataMigrationServlet Insecure Deserialization Vulnerability (CVE-2018-19403)
Integrity Monitoring Rules:
1009639 - Application Shimming (ATT&CK: T1138)
1009672 - Time Providers (ATT&CK: T1209)
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.