Update Details

Update #2749 (06/28/2016)

17 new signatures:

HIGH	HTTP:APACHE:STRUTS-RST-DMI-EXEC	HTTP: Apache Struts REST Plugin DMI Code Execution
HIGH	HTTP:STC:ADOBE:PDF-XFAFRM-OVRFL	HTTP: Adobe PDF Reader CVE-2016-1043 Integer Overflow
MEDIUM	HTTP:UA:MALICIOUS-UA	HTTP: Malicious User-Agents
HIGH	HTTP:EK-RIG-OUT-COMMUNICATION	HTTP: Rig Exploit Kit Outbound Communication Attempt
INFO	HTTP:EK-RED-SIMPLETDS-GO	HTTP:SimpleTDS go.php
HIGH	HTTP:EXPLOIT:DNSCHANGER-EK	HTTP: DNSChanger Exploit Kit Detected
HIGH	HTTP:MALJS-REDIR-EK	HTTP: Malicious Exploit Kit JavaScript Redirection Detected
HIGH	NTP:NTP-NAK-DOS	NTP: Network Time Protocol Daemon crypto-NAK Denial of Service
HIGH	HTTP:EK-KAIXIN-LANDING-PAGE	HTTP: KaiXin Exploit Kit Landing Page
HIGH	HTTP:TREND-MICRO-IWSVA-CMDI	HTTP: Trend Micro IWSVA wmi_domain_controllers Command Injection
HIGH	APP:SOLARWINDS-VMACC-CE	APP: Solarwinds Virtualization Manager Apache Commons Collections Insecure Deserialization
HIGH	HTTP:EK-ANGLER-XTEA-ENYCP-BIN	HTTP: Angler Exploit Kit XTEA Encrypted Binary
HIGH	HTTP:STC:ACTIVEX:MICRO-FOCUS	HTTP: Micro Focus Rumba Unsafe ActiveX Control
HIGH	HTTP:EK-KAIXIN-LANDING-PAGE1	HTTP: KaiXin Exploit Kit Landing Page 1
HIGH	HTTP:EITEST-REDIR-EK	HTTP: EITest Evil Redirection Malicious Javascript Obfuscation
HIGH	HTTP:STC:MEM-COR-EDGE	HTTP: Microsoft Edge CVE-2016-3222 Memory Corruption
MEDIUM	HTTP:PROXY:SQUID-SQSN-HDR-POISN	HTTP: Squid Squoison Host Header Cache Poisoning

4 updated signatures:

HIGH	DB:MYSQL:YASSL-HELLO-BO	DB: MySQL YaSSL SSL Hello Message Buffer Overflow
HIGH	HTTP:PHP:OPENEMR-GLOBALS-AB	HTTP: OpenEMR globals.php Authentication Bypass
HIGH	HTTP:STC:IE:CVE-2016-0186-CE	HTTP: Microsoft Edge CVE-2016-0186 Arbitrary Code Execution
HIGH	HTTP:STC:DL:CVE-2016-3234-CE	HTTP: Microsoft Office Word CVE-2016-3234 Code Execution

Details of the signatures included within this bulletin:

HTTP:STC:IE:CVE-2016-0186-CE - HTTP: Microsoft Edge CVE-2016-0186 Arbitrary Code Execution

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Microsoft Edge. A successful attack can lead to arbitrary code execution.

Supported On:

idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, idp-4.2.0, idp-5.0.0, mx-9.4, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, isg-3.5.0, srx-9.2, srx-branch-9.4, j-series-9.5, idp-4.2.110100823, srx-10.0, srx-branch-10.0, idp-4.2.110101203, idp-5.1.0, idp-4.1.110110609, srx-11.4, srx-branch-11.4, idp-4.1.110110719, mx-11.4, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, vsrx-15.1, isg-3.5.141455, idp-5.1.110151117, isg-3.5.141597, idp-5.1.110160603

References:

cve: CVE-2016-0186

HTTP:EK-KAIXIN-LANDING-PAGE - HTTP: KaiXin Exploit Kit Landing Page

Severity: HIGH

Description:

This signature detects an attempt to download exploits from malicious exploit kits that may compromise a computer through various vendor vulnerabilities. Exploit kits are very specific type of toolkits which are being used by cyber criminals to deliver other pieces of malware.

Supported On:

idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, idp-4.2.0, idp-5.0.0, mx-9.4, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, isg-3.5.0, srx-9.2, srx-branch-9.4, j-series-9.5, idp-4.2.110100823, srx-10.0, srx-branch-10.0, idp-4.2.110101203, idp-5.1.0, idp-4.1.110110609, srx-11.4, srx-branch-11.4, idp-4.1.110110719, mx-11.4, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, vsrx-15.1, isg-3.5.141455, idp-5.1.110151117, isg-3.5.141597, idp-5.1.110160603

HTTP:EITEST-REDIR-EK - HTTP: EITest Evil Redirection Malicious Javascript Obfuscation

Severity: HIGH

Description:

This signature detects an attempt to fingerprint redirections from malicious exploit kits that may compromise a computer through various vendor vulnerabilities. Exploit kits are very specific type of toolkits which are being used by cybercriminals to deliver other pieces of malware.

Supported On:

HTTP:MALJS-REDIR-EK - HTTP: Malicious Exploit Kit JavaScript Redirection Detected

Severity: HIGH

Description:

Supported On:

HTTP:TREND-MICRO-IWSVA-CMDI - HTTP: Trend Micro IWSVA wmi_domain_controllers Command Injection

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Trend Micro Interscan Web Security. A successful attack can lead to arbitrary code execution.

Supported On:

References:

HTTP:PROXY:SQUID-SQSN-HDR-POISN - HTTP: Squid Squoison Host Header Cache Poisoning

Severity: MEDIUM

Description:

This signature detects attempts to exploit a known vulnerability against Squid proxy when configured as a transparent proxy which makes version 3.5.12 vulnerable. Attackers can cause the Squid proxy's cache to become poisoned with the attacker's chosen content.

Supported On:

References:

cve: CVE-2016-4553

HTTP:APACHE:STRUTS-RST-DMI-EXEC - HTTP: Apache Struts REST Plugin DMI Code Execution

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Apache Struts. A successful attack can lead to arbitrary code execution.

Supported On:

References:

cve: CVE-2016-3087

HTTP:STC:ADOBE:PDF-XFAFRM-OVRFL - HTTP: Adobe PDF Reader CVE-2016-1043 Integer Overflow

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Adobe PDF Reader. A successful attack can lead to arbitrary code execution.

Supported On:

srx-branch-11.4, mx-11.4, idp-4.1.0, mx-9.4, srx-9.2, srx-branch-9.4, j-series-9.5, srx-12.1, srx-branch-12.1, srx-10.0, srx-branch-10.0, vsrx-12.1, vsrx-15.1, idp-5.1.110160603, isg-3.5.141455, idp-5.1.110151117, isg-3.5.141597, srx-11.4

References:

cve: CVE-2016-1043

HTTP:UA:MALICIOUS-UA - HTTP: Malicious User-Agents

Severity: MEDIUM

Description:

This signature detects attempts to exploit a known vulnerability against HTTP User-Agent. A successful attack can lead to arbitrary code execution.

Supported On:

HTTP:EK-RIG-OUT-COMMUNICATION - HTTP: Rig Exploit Kit Outbound Communication Attempt

Severity: HIGH

Description:

Supported On:

HTTP:PHP:OPENEMR-GLOBALS-AB - HTTP: OpenEMR globals.php Authentication Bypass

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability in the OpenEMR globals.php script. Successful exploitation will bypass authentication and allow the attacker to gain unauthorized access to the system.

Supported On:

References:

cve: CVE-2015-4453

Affected Products:

open-emr openemr 2.9.0
open-emr openemr 3.2.0
open-emr openemr 4.1.2
open-emr openemr 3.1.0
open-emr openemr 2.8.3
open-emr openemr 3.0.1
open-emr openemr 4.1.0
open-emr openemr 4.0.0
open-emr openemr 4.2.0
open-emr openemr 4.1.1

HTTP:EXPLOIT:DNSCHANGER-EK - HTTP: DNSChanger Exploit Kit Detected

Severity: HIGH

Description:

Supported On:

DB:MYSQL:YASSL-HELLO-BO - DB: MySQL YaSSL SSL Hello Message Buffer Overflow

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability in the MySQL Server. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the server.

Supported On:

idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, idp-4.2.0, idp-5.0.0, mx-9.4, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, isg-3.5.0, srx-9.2, srx-branch-9.4, j-series-9.5, idp-4.2.110100823, srx-10.0, srx-branch-10.0, idp-4.2.110101203, idp-5.1.0, idp-4.1.110110609, srx-11.4, srx-branch-11.4, idp-4.1.110110719, mx-11.4, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, vsrx-15.1, isg-3.5.141455, idp-5.1.110151117, isg-3.5.141597, idp-5.1.110160603

References:

bugtraq: 27140
cve: CVE-2008-0226

Affected Products:

Debian Linux 4.0 Sparc
Debian Linux 4.0
Ubuntu Ubuntu Linux 7.10 Sparc
Ubuntu Ubuntu Linux 6.06 LTS Powerpc
Ubuntu Ubuntu Linux 6.06 LTS I386
Ubuntu Ubuntu Linux 6.06 LTS Amd64
Apple Mac OS X Server 10.5.5
Mandriva Corporate Server 4.0
Mandriva Linux Mandrake 2008.0
Mandriva Linux Mandrake 2008.0 X86 64
Ubuntu Ubuntu Linux 7.10 I386
Ubuntu Ubuntu Linux 6.10 Amd64
Ubuntu Ubuntu Linux 6.10 I386
Ubuntu Ubuntu Linux 7.10 Powerpc
Ubuntu Ubuntu Linux 6.10 Powerpc
Ubuntu Ubuntu Linux 6.10 Sparc
Ubuntu Ubuntu Linux 7.04 Amd64
Ubuntu Ubuntu Linux 7.04 I386
Ubuntu Ubuntu Linux 7.04 Powerpc
Ubuntu Ubuntu Linux 7.04 Sparc
Ubuntu Ubuntu Linux 6.06 LTS Sparc
yaSSL 1.7.5
Mandriva Linux Mandrake 2007.1
Mandriva Linux Mandrake 2007.1 X86 64
Mandriva Corporate Server 4.0.0 X86 64
Ubuntu Ubuntu Linux 7.10 Amd64
Debian Linux 4.0 Alpha
Debian Linux 4.0 Amd64
Debian Linux 4.0 Arm
Debian Linux 4.0 Hppa
Debian Linux 4.0 Ia-32
Debian Linux 4.0 Ia-64
Debian Linux 4.0 M68k
Debian Linux 4.0 Mips
Debian Linux 4.0 Mipsel
Debian Linux 4.0 Powerpc
Debian Linux 4.0 S/390

NTP:NTP-NAK-DOS - NTP: Network Time Protocol Daemon crypto-NAK Denial of Service

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability in the Network Time Protocol daemon (NTPD). Successful exploitation may result in denial-of-service conditions.

Supported On:

References:

cve: CVE-2016-4957

HTTP:EK-ANGLER-XTEA-ENYCP-BIN - HTTP: Angler Exploit Kit XTEA Encrypted Binary

Severity: HIGH

Description:

Supported On:

APP:SOLARWINDS-VMACC-CE - APP: Solarwinds Virtualization Manager Apache Commons Collections Insecure Deserialization

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Solarwinds Virtualization Manager. Successful exploitation can result in arbitrary code execution in the security context of the RMI service.

Supported On:

References:

cve: CVE-2016-3642

HTTP:EK-RED-SIMPLETDS-GO - HTTP:SimpleTDS go.php

Severity: INFO

Description:

Supported On:

HTTP:STC:ACTIVEX:MICRO-FOCUS - HTTP: Micro Focus Rumba Unsafe ActiveX Control

Severity: HIGH

Description:

This signature detects attempts to use unsafe ActiveX controls in Micro Focus Rumba. An attacker can create a malicious Web site containing Web pages with dangerous ActiveX controls, which if accessed by a victim, allows the attacker to gain control of the victim's client browser.

Supported On:

DI-Client, DI-Worm, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, idp-4.2.0, idp-5.0.0, mx-9.4, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, isg-3.5.0, srx-9.2, srx-branch-9.4, j-series-9.5, idp-4.2.110100823, srx-10.0, srx-branch-10.0, idp-4.2.110101203, idp-5.1.0, idp-4.1.110110609, srx-11.4, srx-branch-11.4, idp-4.1.110110719, mx-11.4, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, vsrx-15.1, isg-3.5.141455, idp-5.1.110151117, isg-3.5.141597, idp-5.1.110160603

HTTP:EK-KAIXIN-LANDING-PAGE1 - HTTP: KaiXin Exploit Kit Landing Page 1

Severity: HIGH

Description:

Supported On:

HTTP:STC:DL:CVE-2016-3234-CE - HTTP: Microsoft Office Word CVE-2016-3234 Code Execution

Severity: HIGH

Description:

This signature detects an attempt to exploit a known vulnerability against Microsoft Office Word. Successful exploitation of this issue could allow an attacker to leak sensitive information or execute code on remote system.

Supported On:

References:

cve: CVE-2016-3234

HTTP:STC:MEM-COR-EDGE - HTTP: Microsoft Edge CVE-2016-3222 Memory Corruption

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Microsoft Edge. A successful attack can lead to arbitrary code execution

Supported On:

References:

cve: CVE-2016-3222