Cloud One Workload Security and Deep Security Updates
- * indicates a new version of an existing rule
Deep Packet Inspection Rules:
DCERPC Services
1003292* - Block Conficker.B++ Worm Incoming Named Pipe Connection
1004807* - Identified SMB Raw Named Pipe In Write Mode
DCERPC Services - Client
1007494* - Adobe Acrobat DLL Loading Arbitrary Code Execution Vulnerability (CVE-2016-1008)
1003293* - Block Conficker.B++ Worm Outgoing Named Pipe Connection
1004373* - Identified Microsoft DLL File Over Network Share
1007426* - Microsoft Windows DLL Loading Vulnerabilities Over Network Share (MS16-014)
Database MySQL
1005063* - Restrict MySQL Database Access
Database Oracle
1004995* - Oracle Database TNS Listener Poison Attack Vulnerability
FTP Server Common
1003784* - FTP Server Restrict Executable File Uploads
1005461* - Identified FTP Connection Without AUTH Command
HP Intelligent Management Center (IMC)
1008806 - HPE Intelligent Management Center FileUploadServlet Directory Traversal Vulnerability (CVE-2017-5794)
HP Intelligent Management Center Dbman
1008790 - HPE Intelligent Management Center dbman Opcode 10012 Use-After-Free Remote Code Execution Vulnerability (CVE-2017-12561)
Mail Server Exim
1008758* - Exim Unix Mailer Multiple Security Vulnerabilities
Microsoft Office
1004853* - Identified Suspicious Microsoft Office Files With Embedded Font
1005615* - Identified Suspicious Usage Of Shellcode In Microsoft Office Files
1004647* - Restrict Microsoft Office File With Embedded SWF
1005158* - Restrict Microsoft Office Files With Embedded SWF - 2
Novell File Reporter (NFR) Agent
1005260* - Novell File Reporter SRS XML Server Request With Path Element Detected
Oracle Tuxedo JOLT
1008845 - Oracle Tuxedo Remote Security Vulnerability (CVE-2017-10269)
Suspicious Client Application Activity
1005067* - Identified Potentially Harmful Client Traffic
1005283* - Identified Potentially Malicious RAT Traffic - I
1005299* - Identified Potentially Malicious RAT Traffic - III
1005300* - Identified Potentially Malicious RAT Traffic - IV
1005473* - Identified Potentially Malicious RAT Traffic - V
Suspicious Server Application Activity
1005090* - Identified Potentially Harmful Server Traffic
Unix SSH
1000798* - Unix OpenSSH sshd Identical Blocks DoS
Web Application Common
1004888* - Restrict Number Of Parameters In HTTP Request
Web Application PHP Based
1005465* - Identified Access To WordPress Sensitive Files
1006021* - Joomla JCE Extension Multiple Vulnerabilities
1000208* - SquirrelMail IMAP Command Injection Vulnerability
1000209* - SquirrelMail SMTP Command Injection Vulnerability
1006432* - WordPress Slider Revolution Responsive/Showbiz Pro Responsive Teaser Multiple Security Bypass Vulnerabilities
Web Client Common
1008833 - Foxit Reader JPEG2000 Out-Of-Bounds Read Information Disclosure Vulnerabilities
1005389* - Identified Suspicious Download Of Executable File Over HTTP
1004900* - Identified Suspicious Microsoft Office Files With Embedded Objects
Web Client Internet Explorer/Edge
1004339* - Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability
Web Server Common
1008724* - Trend Micro SafeSync For Enterprise 'device_id' 'role' Command Injection Vulnerability
1008723* - Trend Micro SafeSync For Enterprise Command Injection Vulnerability
Web Server Miscellaneous
1008673 - IBM Informix Open Admin Tool Heap Buffer Overflow Vulnerability (CVE-2017-1092)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update. - * indicates a new version of an existing rule
Deep Packet Inspection Rules:
Arcserve Unified Data Protection
1008711 - Arcserve Unified Data Protection Management Service Information Disclosure Vulnerability (CVE-2015-4069)
DCERPC Services
1008327* - Identified Server Suspicious SMB Session
1008558* - Identified Windows Search Protocol Network Traffic Over SMB
1008380 - Microsoft Windows Group Policy Preferences Password Elevation Of Privilege Vulnerability (CVE-2014-1812)
1008225* - Microsoft Windows SMB Remote Code Execution Vulnerability (CVE-2017-0145)
1008713 - Microsoft Windows SMB Server SMBv1 Information Disclosure Vulnerability (CVE-2017-11815)
1008560* - Microsoft Windows Search Remote Code Execution Vulnerability (CVE-2017-8620)
1000735* - Microsoft Windows Server Service Remote Code Execution
DCERPC Services - Client
1007592* - Microsoft Windows DLL Loading Vulnerabilities Over Network Share (CVE-2016-0160 and CVE-2016-0148)
Database Microsoft SQL
1008559 - Microsoft SQL Server Buffer Overflow Vulnerability (CVE-2008-0106)
Directory Server LDAP
1008459 - Samba NDR Parsing Remote Code Execution Vulnerability (CVE-2016-2123)
HP Intelligent Management Center (IMC)
1008748* - HPE Intelligent Management Center PLAT flexFileUpload Arbitrary File Upload Vulnerability (CVE-2017-8961)
1008686 - HPE Operations Orchestration Deserialization Remote Code Execution Vulnerability (CVE-2016-8519)
Microsoft Office
1008839 - Microsoft Office Memory Corruption Vulnerability (CVE-2018-0802)
NTP Client
1008632* - Identified Zero Origin Timestamp In NTP Traffic
NTP Server Linux
1008320* - Network Time Protocol Daemon 'peer_xmit' Mode Denial Of Service Vulnerability (CVE-2017-6464)
OpenSSL
1008715* - OpenSSL X.509 IPAddressFamily Extension Parsing Out-Of-Bounds Read Vulnerability (CVE-2017-3735) - Server
Oracle Tuxedo JOLT
1008798 - Oracle Tuxedo Jolt Heap Buffer Overflow Vulnerability (CVE-2017-10278)
RADIUS Server
1008614* - FreeRADIUS Heap Buffer Overflow Vulnerability (CVE-2017-10984)
SSL Client
1008714* - OpenSSL X.509 IPAddressFamily Extension Parsing Out-Of-Bounds Read Vulnerability (CVE-2017-3735) - Client
Symantec Messaging Gateway
1008741 - Symantec Messaging Gateway Remote Code Execution Vulnerability (CVE-2017-6326)
Trend Micro Control Manager
1008760 - Trend Micro Control Manager SQL Injection Vulnerability (CVE-2017-11383)
1008589 - Trend Micro Control Manager cmdHandlerLicenseManager SQL Injection Vulnerability (CVE-2017-11384)
Unix RPC Services
1008433* - Solaris Calendar Manager Service Daemon (rpc.cmsd) Remote Code Execution Vulnerability (CVE-2017-3632)
Unix Samba
1008644 - Samba Arbitrary File Write Vulnerability (CVE-2017-12163)
Web Application PHP Based
1008550* - PHP 'imagegammacorrect' Function Arbitrary Write Access vulnerability (CVE-2016-7127)
1008520* - PHP Malicious Object Injection In Deserialization Vulnerability (CVE-2016-7124)
1008562* - PHP libgd Signedness Heap Overflow Vulnerability (CVE-2016-3074)
Web Application Ruby Based
1008574* - Ruby On Rails Development Web Console Code Execution Vulnerability (CVE-2015-3224)
Web Client Common
1008736* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB17-36) - 6
1008738* - Adobe Flash Player Multiple Security Vulnerabilities (APSB17-33)
1008726 - Foxit Reader Multiple Use-After-Free Remote Code Execution Vulnerabilities
1007931* - Microsoft Windows Information Disclosure Vulnerability (CVE-2016-3352)
1008828* - Speculative Execution Information Disclosure Vulnerabilities (Spectre)
Web Client Internet Explorer/Edge
1008836 - Microsoft Edge Scripting Engine Information Disclosure Vulnerability (CVE-2018-0767)
1008704* - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2017-11840)
1008706* - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2017-11873)
1008697* - Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2017-11855)
Web Server Miscellaneous
1008794* - Apache Struts2 Jackson JSON Library Deserializer Remote Code Execution Vulnerability (CVE-2017-7525)
1008207* - Apache Struts2 Remote Code Execution Vulnerability (CVE-2017-5638)
1008674 - IBM Informix Open Admin Tool Remote Code Execution Vulnerability (CVE-2017-1092)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update. - * indicates a new version of an existing rule
Deep Packet Inspection Rules:
DCERPC Services
1008717* - Microsoft Windows Search Remote Code Execution Vulnerability (CVE-2017-11771)
DCERPC Services - Client
1007369* - Microsoft Windows DLL Loading Vulnerabilities Over Network Share (MS16-007)
DNS Client
1002657* - Identified Too Many DNS Responses
1008793 - systemd Network Name Resolution Manager NSEC Resource Record Pseudo-Types Denial Of Service Vulnerability (CVE-2017-15908)
Microsoft Office
1008831 - Microsoft Word Memory Corruption Vulnerability (CVE-2018-0797)
Web Application PHP Based
1008518* - PHP Double Free Memory Corruption Vulnerability (CVE-2016-5772)
Web Client Common
1008830 - Adobe Flash Player Memory Corruption Vulnerability (APSB18-01)
Web Server Common
1008724 - Trend Micro SafeSync For Enterprise 'device_id' 'role' Command Injection Vulnerability
1008723 - Trend Micro SafeSync For Enterprise Command Injection Vulnerability
Web Server Miscellaneous
1008794 - Apache Struts2 Jackson JSON Library Deserializer Remote Code Execution Vulnerability (CVE-2017-7525)
Web Server Oracle
1008808* - Oracle WebLogic WLS Security Component Remote Code Execution Vulnerabilities
Integrity Monitoring Rules:
1008720 - Users and Groups - Create and Delete Activity
Log Inspection Rules:
1008619 - Application - Docker
1003843* - Microsoft Windows Security Events
1004057* - Microsoft Windows Security Events - 1
1003987* - Microsoft Windows Security Events - 2
1008670* - Microsoft Windows Security Events - 3
1008792* - Microsoft Windows Security Events - 4 - * indicates a new version of an existing rule
Deep Packet Inspection Rules:
Web Client Common
1008828 - Speculative Execution Information Disclosure Vulnerabilities (Spectre)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update. - * indicates a new version of an existing rule
Deep Packet Inspection Rules:
Web Client Internet Explorer/Edge
1008826 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0758)
1008825 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0769)
1008824 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0773)
1008821 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0774)
1008822 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0775)
1008820 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0776)
1008819 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0777)
1008823 - Microsoft Internet Explorer And Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0762)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update. - * indicates a new version of an existing rule
Deep Packet Inspection Rules:
Microsoft Office
1008801 - Microsoft Office Memory Corruption Vulnerability (CVE-2017-11884)
NTP Server Linux
1008320 - Network Time Protocol Daemon 'peer_xmit' Mode Denial Of Service Vulnerability (CVE-2017-6464)
RADIUS Server
1008614 - FreeRADIUS Heap Buffer Overflow Vulnerability (CVE-2017-10984)
Web Client Common
1008656* - Microsoft JET Database Engine Remote Code Execution Vulnerability (CVE-2017-8718)
1008805 - Microsoft JET Database Engine Remote Code Execution Vulnerability (CVE-2017-8718) - 1
Web Client Internet Explorer/Edge
1008803 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2017-11812)
1008616* - Microsoft Internet Explorer And Edge Scripting Engine Memory Corruption Vulnerability (CVE-2017-8641)
1008698* - Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2017-11856)
Web Server Oracle
1008808 - Oracle WebLogic WLS Security Component Remote Code Execution Vulnerabilities
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update. - * indicates a new version of an existing rule
Deep Packet Inspection Rules:
HP Intelligent Management Center (IMC)
1008748 - HPE Intelligent Management Center PLAT flexFileUpload Arbitrary File Upload Vulnerability (CVE-2017-8961)
Unix RPC Services
1008314* - Oracle Solaris Remote Code Execution Vulnerability (CVE-2017-3623)
Web Application PHP Based
1008518 - PHP Double Free Memory Corruption Vulnerability (CVE-2016-5772)
1008520 - PHP Malicious Object Injection In Deserialization Vulnerability (CVE-2016-7124)
Web Client Internet Explorer/Edge
1008636* - Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2017-11793)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update. - * indicates a new version of an existing rule
Deep Packet Inspection Rules:
DCERPC Services
1008717 - Microsoft Windows Search Remote Code Execution Vulnerability (CVE-2017-11771)
DHCP Server
1008591* - FreeRADIUS Integer Underflow Out Of Bounds Read Vulnerability (CVE-2017-10986)
HP Intelligent Management Center Dbman
1008749* - HPE Intelligent Management Center Dbman Stack Buffer Overflow Vulnerability (CVE-2017-8956)
RRAS Service
1008769* - Microsoft Windows RRAS Service Remote Code Execution Vulnerability (CVE-2017-11885)
Remote Desktop Protocol Server
1008307* - Microsoft Windows Remote Desktop Protocol Remote Code Execution Vulnerability (CVE-2017-0176)
Unix Samba
1008791* - Samba Arbitrary Code Execution Vulnerability (CVE-2017-14746)
Web Application PHP Based
1008550 - PHP 'imagegammacorrect' Function Arbitrary Write Access vulnerability (CVE-2016-7127)
1008562 - PHP libgd Signedness Heap Overflow Vulnerability (CVE-2016-3074)
Web Application Ruby Based
1008574 - Ruby On Rails Development Web Console Code Execution Vulnerability (CVE-2015-3224)
Web Client Common
1008583 - Foxit Reader Arbitrary File Write Remote Code Execution Vulnerability (CVE-2017-10952)
1008582 - Foxit Reader Remote Code Execution Vulnerability (CVE-2017-10951)
Web Server Miscellaneous
1008763* - Red Hat JBoss Application Server 'doFilter' Insecure Deserialization Vulnerability (CVE-2017-12149)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
1008792 - Microsoft Windows Security Events - 4 - * indicates a new version of an existing rule
Deep Packet Inspection Rules:
DCERPC Services
1008119* - Microsoft Windows Local Security Authority Subsystem Service (LSASS) Denial Of Service Vulnerability (CVE-2017-0004)
DHCP Server
1008591 - FreeRADIUS Integer Underflow Out Of Bounds Read Vulnerability (CVE-2017-10986)
Microsoft Office
1008788 - Microsoft Excel Remote Code Execution Vulnerability (CVE-2017-11935)
1008661* - Microsoft Office Memory Corruption Vulnerability (CVE-2017-11826)
RRAS Service
1008769 - Microsoft Windows RRAS Service Remote Code Execution Vulnerability (CVE-2017-11885)
Solr Service
1008691* - Apache Solr XML External Entity Expansion Remote Code Execution (CVE-2017-12629)
Unix RPC Services
1008371* - rpcbind Remote Denial Of Service Vulnerability (CVE-2017-8779)
Unix Samba
1008791 - Samba Arbitrary Code Execution Vulnerability (CVE-2017-14746)
VoIP Smart
1008465 - Asterisk PJSIP Heap Overflow Vulnerability (CVE-2017-9372)
Web Client Common
1008736* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB17-36) - 6
1008740* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB17-36) - 7
1008789 - Microsoft Malware Protection Engine Remote Code Execution Vulnerability (CVE-2017-11937)
1008643* - Microsoft Windows Shell Memory Corruption Vulnerability (CVE-2017-8727)
1008672 - Microsoft Windows XML External Entity Information Disclosure Vulnerability (CVE-2017-8710)
Web Client Internet Explorer/Edge
1008771 - Microsoft Edge Memory Corruption Vulnerability (CVE-2017-11888)
1008772 - Microsoft Edge Memory Corruption Vulnerability (CVE-2017-11889)
1008774 - Microsoft Edge Memory Corruption Vulnerability (CVE-2017-11893)
1008780 - Microsoft Edge Memory Corruption Vulnerability (CVE-2017-11909)
1008781 - Microsoft Edge Memory Corruption Vulnerability (CVE-2017-11911)
1008783 - Microsoft Edge Memory Corruption Vulnerability (CVE-2017-11914)
1008784 - Microsoft Edge Memory Corruption Vulnerability (CVE-2017-11916)
1008785 - Microsoft Edge Memory Corruption Vulnerability (CVE-2017-11918)
1008682 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2017-11811)
1008775 - Microsoft Internet Explorer And Edge Memory Corruption Vulnerability (CVE-2017-11894)
1008776 - Microsoft Internet Explorer And Edge Memory Corruption Vulnerability (CVE-2017-11895)
1008787 - Microsoft Internet Explorer And Edge Memory Corruption Vulnerability (CVE-2017-11930)
1008770 - Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2017-11886)
1008773 - Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2017-11890)
1008777 - Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2017-11901)
1008778 - Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2017-11903)
1008779 - Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2017-11907)
1008782 - Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2017-11913)
Web Server Apache
1008683* - Apache HTTP Server Memory Corruption Vulnerability (CVE-2017-9788)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
1003843* - Microsoft Windows Security Events
1004057* - Microsoft Windows Security Events - 1
1003987* - Microsoft Windows Security Events - 2
1008670 - Microsoft Windows Security Events - 3 - * indicates a new version of an existing rule
Deep Packet Inspection Rules:
DCERPC Services
1008622 - Identified NTLMv1 Authentication Attempt Over SMB
1008660* - Microsoft Windows SMB Out-Of-Bounds Read Denial Of Service Vulnerability (CVE-2017-11781)
DNS Client
1002657* - DNS Insufficient Socket Entropy Vulnerability
1005020* - Detected Too Many DNS Responses With 'No Such Name' Error
1005101* - ISC BIND Zero Length RDATA Denial Of Service Vulnerability
1003928* - Oracle Secure Backup observiced.exe Buffer Overflow
DNS Server
1000836* - Microsoft Windows NAT Helper DNS Query DoS
1000167* - Snort Back Orifice Pre-Processor Buffer Overflow
HP Intelligent Management Center Dbman
1008749 - HPE Intelligent Management Center Dbman Stack Buffer Overflow Vulnerability (CVE-2017-8956)
HP Network Automation
1008676* - HPE Network Automation FileServlet Information Disclosure Vulnerability (CVE-2017-5811)
Mail Server Exim
1008758 - Exim Unix Mailer Multiple Security Vulnerabilities
SSL/TLS Server
1008534* - GnuTLS Proxy Certificate Information Extension Memory Corruption Vulnerability (CVE-2017-5334) - Server
Unix Kerberos
1008561* - Kerberos kadmind Policy Null Pointer Dereference Denial Of Service Vulnerability (CVE-2015-8630)
Web Application PHP Based
1008626* - Drupal Services Module Remote Code Execution Vulnerability
1008548* - PHP Session Data Injection Vulnerability (CVE-2016-7125)
Web Client Common
1008702 - Microsoft Windows GDI Information Disclosure Vulnerability (CVE-2017-11816)
Web Client Internet Explorer/Edge
1008635* - Microsoft Windows Graphics Remote Code Execution Vulnerability (CVE-2017-11763)
Web Server Miscellaneous
1008751 - Apache CouchDB Remote Code Execution Vulnerabilities (CVE-2017-12635)
1004610* - Oracle Java SE And Java For Business Remote Security Vulnerability (CVE-2010-4476)
1008763 - Red Hat JBoss Application Server 'doFilter' Insecure Deserialization Vulnerability (CVE-2017-12149)
Integrity Monitoring Rules:
1005195* - Microsoft Windows - Log File Attributes Changes Detected
1005193* - Unix - Log File Attributes Changes Detected
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.