Juniper Networks
Solutions
Products & Services
Company
Partners
Support
Education

Update Details

Security Intelligence Center
Print

Update #2840 (03/23/2017)

EOL Announcement (January 3, 2017): End-of-Life Notification for Juniper Networks IDP/AppID Signature Releases on EOL products. Please see TSB17019 for more information.

10 new signatures:

HIGHAPP:LINUX-KERNEL-SCTP-OOBAPP: Linux Kernel SCTP sctp_sf_ootb Out of Bounds Read
HIGHAPP:IBM:TIVOLI-STORAGE-MGR-BOFAPP: Tivoli Storage Manager Buffer Overflow
MEDIUMHTTP:STC:DL:CVE-2015-3205-RCEHTTP: Libmimedir VCF Memory Corruption
MEDIUMHTTP:STC:DL:CVE-2016-0954-RCEHTTP: Adobe Digital Editions CVE-2016-0954 Critical Memory Corruption
HIGHHTTP:STC:IMG:PNG-CHUNK-OF-2HTTP: PNG Type Chunk Overflow (2)
HIGHHTTP:EK-MUL-SUCCESSFUL-REDIR3HTTP: Multiple Exploit Kit Successful Redirection (3)
MEDIUMHTTP:SUSP-HDR-REDRCT-EXP-131HTTP:SUSP-HDR-REDRCT Infection-131
MEDIUMHTTP:SYMC-DCS-CVE-2014-9225-IDHTTP: Symantec Data Center Security CVE-2014-9225 Information Disclosure
HIGHSHELLCODE:PREPENDENCODER-HTTP-3SHELLCODE: Prepend Encoder Routine Detection Over HTTP (3)
MEDIUMDNS:SQUID-DNS-REPLIES2DNS: Squid DNS Replies Invalid Free

19 updated signatures:

MEDIUMHTTP:STATIC-SERVER-BOF1HTTP: Static HTTP Server ini File Parsing Buffer Overflow1
HIGHSHELLCODE:PREPENDENCODER-HTTP-2SHELLCODE: Prepend Encoder Routine Detection Over HTTP (2)
HIGHHTTP:STC:DL:SYM-AV-RAR-BOHTTP: Symantec AntiVirus RAR Archive Decompression Buffer Overflow
HIGHHTTP:STC:DL:CVE-2017-0014-RCEHTTP: Microsoft Office CVE-2017-0014 Remote Code Execution
HIGHHTTP:STC:IE:CVE-2017-0023-RCEHTTP: Microsoft Edge CVE-2017-0023 Remote Code Execution
HIGHHTTP:STC:IE:OBJECT-PROCESING-CEHTTP: Microsoft Internet Explorer Obeject Handling Remote Code Execution
HIGHHTTP:STC:ADOBE:MAL-FLV-BOFHTTP: Adobe Flash Player Malformed FLV File Buffer Overflow
HIGHHTTP:LIBGD-GD2GETHEADER-IOHTTP: GD Library libgd _gd2GetHeader Integer Overflow
CRITICALHTTP:STC:IMG:PNG-CHUNK-OF-1HTTP: PNG Type Chunk Overflow (1)
MEDIUMTROJAN:BACKDOOR:SCREENOS-SSHTROJAN: Juniper ScreenOS SSH Response
HIGHHTTP:STC:DL:MAL-M3UHTTP: M3U Malformed File Format
MEDIUMHTTP:MAL-REDIRECT-EXP-130HTTP:MAL-REDIRECT Infection-130
MEDIUMHTTP:EXT:FILE-EXT-IN-DIRHTTP: File Extension in Directory Name
HIGHAPP:OPENVIEW-STORAGE-BOAPP: HP Open View Strage Data Protector Stack Buffer Overflow
HIGHHTTP:EK-MUL-SUCCESSFUL-REDIR2HTTP: Multiple Exploit Kit Successful Redirection (2)
HIGHSHELLCODE:PREPENDENCODER-HTTP-1SHELLCODE: Prepend Encoder Routine Detection Over HTTP (1)
HIGHAPP:PROXY:SQUID-PROXY-CACHEAPP: Squid Proxy Cache cachemgr.cgi Resource Exhaustion
HIGHDNS:PDNS-AUTHSERV-DOSDNS: PowerDNS Authoritative Server DNS Packet Processing Denial of Service
MEDIUMHTTP:STC:ACTIVEX:CVE-2017-0022HTTP: Microsoft XML Core Services CVE-2017-0022 Unsafe ActiveX Control

3 renamed signatures:

SHELLCODE:MALFORMED-RESPONSE1->SHELLCODE:PREPENDENCODER-HTTP-2
HTTP:EK-MUL-SUCCESSFUL-REDIR1->HTTP:EK-MUL-SUCCESSFUL-REDIR2
HTTP:STC:IMG:PNG-CHUNK-OF->HTTP:STC:IMG:PNG-CHUNK-OF-1


Details of the signatures included within this bulletin:

HTTP:STATIC-SERVER-BOF1 - HTTP: Static HTTP Server ini File Parsing Buffer Overflow1

Severity: MEDIUM

Description:

This signature detects attempts to exploit a known vulnerability in Static HTTP server. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the targeted server.

Supported On:

isg-3.5.141652, idp-5.1.110161014, idp-4.1.110110719, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, idp-5.0.0, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, isg-3.5.0, isg-3.4.139899, j-series-9.5, srx-12.1, srx-branch-12.1, idp-4.2.110100823, idp-5.0.110130325, mx-11.4, isg-3.4.140032, idp-4.2.110101203, vsrx-12.1, idp-5.1.0, idp-5.0.110121210, vsrx-15.1, idp-4.1.110110609, isg-3.5.141597, idp-5.1.110160603

References:

  • url: http://www.supermicro.com/products/nfo/files/IPMI/CVE_Update.pdf
  • cve: CVE-2013-3623

Affected Products:

  • supermicro intelligent_platform_management_firmware 2.24 (-:~-~-~-~x9_generation_motherboards~)
  • supermicro intelligent_platform_management_firmware up to 2.26 (-:~-~-~-~x9_generation_motherboards~)

SHELLCODE:PREPENDENCODER-HTTP-2 - SHELLCODE: Prepend Encoder Routine Detection Over HTTP (2)

Severity: HIGH

Description:

This signature detects improper or malformed HTTP server responses that are lacking a HTTP status code. Section 10 of RFC2616 defines the correct HTTP status codes. This may be an indication of tunneling, an IPS evasion attempt or other malicious activity and should be investigated.

Supported On:

srx-branch-12.1, isg-3.5.141652, mx-11.4, idp-5.1.110161014, idp-4.1.0, mx-16.1, vsrx-12.1, vsrx-15.1, srx-12.1, j-series-9.5, isg-3.5.141597, idp-5.1.110160603

References:

  • cve: CVE-2008-1104

Affected Products:

  • foxitsoftware reader 2.2
  • foxitsoftware reader up to 2.3
  • foxitsoftware reader 2.0

HTTP:STC:ADOBE:MAL-FLV-BOF - HTTP: Adobe Flash Player Malformed FLV File Buffer Overflow

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Adobe Flash Player. A successful attack can lead to arbitrary code execution.

Supported On:

isg-3.5.141652, idp-5.1.110161014, idp-4.1.110110719, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, idp-5.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, isg-3.5.0, isg-3.4.139899, j-series-9.5, srx-12.1, srx-branch-12.1, idp-4.2.110100823, idp-5.0.110130325, mx-11.4, isg-3.4.140032, idp-4.2.110101203, vsrx-12.1, idp-5.1.0, idp-5.0.110121210, vsrx-15.1, idp-4.1.110110609, isg-3.5.141597, idp-5.1.110160603

References:

  • cve: CVE-2015-3113

Affected Products:

  • adobe flash_player 17.0.0.169
  • adobe flash_player 17.0.0.134
  • adobe flash_player 15.0.0.246
  • adobe flash_player 15.0.0.223
  • adobe flash_player 13.0.0.292
  • adobe flash_player 15.0.0.167
  • adobe flash_player 18.0.0.161
  • adobe flash_player 16.0.0.257
  • adobe flash_player 14.0.0.179
  • adobe flash_player 15.0.0.152
  • adobe flash_player 16.0.0.287
  • adobe flash_player 17.0.0.188
  • adobe flash_player 11.2.202.466
  • adobe flash_player 14.0.0.125
  • adobe flash_player 15.0.0.239
  • adobe flash_player 15.0.0.189
  • adobe flash_player 16.0.0.296
  • adobe flash_player 14.0.0.176
  • adobe flash_player 16.0.0.235
  • adobe flash_player 14.0.0.145

SHELLCODE:PREPENDENCODER-HTTP-1 - SHELLCODE: Prepend Encoder Routine Detection Over HTTP (1)

Severity: HIGH

Description:

This signature detects payloads being transferred over network that use the PrependEncoder routine. This may be an indication of someone trying to drop malicious file content on targeted systems to achieve remote code execution.

Supported On:

isg-3.5.141652, idp-5.1.110161014, idp-4.1.110110719, idp-4.0.0, mx-11.4, isg-3.4.140032, idp-4.1.0, mx-16.1, idp-4.2.0, idp-5.0.0, isg-3.5.0, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, idp-4.0.110090831, isg-3.4.139899, j-series-9.5, srx-12.1, srx-branch-12.1, idp-4.2.110100823, idp-5.0.110130325, idp-4.0.110090709, idp-4.2.110101203, vsrx-12.1, idp-5.1.0, idp-5.0.110121210, vsrx-15.1, idp-4.1.110110609, isg-3.5.141597, idp-5.1.110160603

TROJAN:BACKDOOR:SCREENOS-SSH - TROJAN: Juniper ScreenOS SSH Response

Severity: MEDIUM

Description:

This signature detects ssh response originating from a netscreen firewall. Trigger of this signature from unauthorized ip address may violate your organization's access policy. This signature can be used to identify these violations.

Supported On:

isg-3.5.141652, idp-5.1.110161014, idp-4.1.110110719, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, idp-5.0.0, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, isg-3.5.0, isg-3.4.139899, j-series-9.5, srx-12.1, srx-branch-12.1, idp-4.2.110100823, idp-5.0.110130325, mx-11.4, isg-3.4.140032, idp-4.2.110101203, vsrx-12.1, idp-5.1.0, idp-5.0.110121210, vsrx-15.1, idp-4.1.110110609, isg-3.5.141597, idp-5.1.110160603

References:

  • cve: CVE-2015-7755

Affected Products:

  • juniper screenos 6.3.0

HTTP:STC:DL:MAL-M3U - HTTP: M3U Malformed File Format

Severity: HIGH

Description:

This signature detects attempts to exploit flaws in M3U files. M3U file type is primarily associated with 'MP3 Playlist File'. Standards are defined for representing a m3u file. Any deviation from it can be an indication of malicious activity. This kind of behavior is mostly noticeable from exploits created using Metasploit Framework.

Supported On:

isg-3.5.141652, idp-5.1.110161014, idp-4.1.110110719, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, idp-5.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, isg-3.5.0, isg-3.4.139899, j-series-9.5, srx-12.1, srx-branch-12.1, idp-4.2.110100823, idp-5.0.110130325, mx-11.4, isg-3.4.140032, idp-4.2.110101203, vsrx-12.1, idp-5.1.0, idp-5.0.110121210, vsrx-15.1, idp-4.1.110110609, isg-3.5.141597, idp-5.1.110160603

References:

  • cve: CVE-2006-0720
  • url: http://en.wikipedia.org/wiki/M3U
  • url: http://www.assistanttools.com/articles/m3u_playlist_format.shtml
  • bugtraq: 41145
  • cve: CVE-2006-3431
  • bugtraq: 18872

Affected Products:

  • nullsoft winamp 5.12
  • nullsoft winamp 5.13

HTTP:MAL-REDIRECT-EXP-130 - HTTP:MAL-REDIRECT Infection-130

Severity: MEDIUM

Description:

This signature detects an attempt to download exploits from malicious exploit kits that may compromise a computer through various vendor vulnerabilities. Exploit kits are very specific type of toolkits which are being used by cybercriminals to deliver other pieces of malware.

Supported On:

vsrx-15.1, srx-12.1

APP:OPENVIEW-STORAGE-BO - APP: HP Open View Strage Data Protector Stack Buffer Overflow

Severity: HIGH

Description:

This signature detects an attempt to exploit a Buffer Overflow vulnerability against HP Open View Storage. Successful exploitation could allow an attacker to execute arbitrary codes into the context of the running application

Supported On:

isg-3.5.141652, idp-5.1.110161014, idp-4.1.110110719, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, idp-5.0.0, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, isg-3.5.0, isg-3.4.139899, j-series-9.5, srx-12.1, srx-branch-12.1, idp-4.2.110100823, idp-5.0.110130325, mx-11.4, isg-3.4.140032, idp-4.2.110101203, vsrx-12.1, idp-5.1.0, idp-5.0.110121210, vsrx-15.1, idp-4.1.110110609, isg-3.5.141597, idp-5.1.110160603

SHELLCODE:PREPENDENCODER-HTTP-3 - SHELLCODE: Prepend Encoder Routine Detection Over HTTP (3)

Severity: HIGH

Description:

This signature detects improper or malformed HTTP server responses that are lacking a HTTP status code. Section 10 of RFC2616 defines the correct HTTP status codes. This may be an indication of tunneling, an IPS evasion attempt or other malicious activity and should be investigated.

Supported On:

srx-branch-12.1, isg-3.5.141652, mx-11.4, idp-5.1.110161014, idp-4.1.0, mx-16.1, vsrx-12.1, vsrx-15.1, srx-12.1, j-series-9.5, isg-3.5.141597, idp-5.1.110160603

References:

  • cve: CVE-2008-1104

Affected Products:

  • foxitsoftware reader 2.2
  • foxitsoftware reader up to 2.3
  • foxitsoftware reader 2.0

DNS:SQUID-DNS-REPLIES2 - DNS: Squid DNS Replies Invalid Free

Severity: MEDIUM

Description:

This signature detects attempts to exploit a known vulnerability against Squid while processing certain DNS replies. A successful attack can lead to arbitrary code execution.

Supported On:

isg-3.5.141652, idp-5.1.110161014, idp-4.1.110110719, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, idp-5.0.0, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, isg-3.5.0, isg-3.4.139899, j-series-9.5, srx-12.1, srx-branch-12.1, idp-4.2.110100823, idp-5.0.110130325, mx-11.4, isg-3.4.140032, idp-4.2.110101203, vsrx-12.1, idp-5.1.0, idp-5.0.110121210, vsrx-15.1, idp-4.1.110110609, isg-3.5.141597, idp-5.1.110160603

References:

  • bugtraq: 50449
  • cve: CVE-2011-4096

Affected Products:

  • squid-cache squid 3.1.0.15
  • squid-cache squid 3.1.13
  • squid-cache squid 3.0.stable6
  • squid-cache squid 3.1.0.12
  • squid-cache squid 3.1.10
  • squid-cache squid 3.0.stable7
  • squid-cache squid 3.0.stable12
  • squid-cache squid 3.1.0.13
  • squid-cache squid 3.1.11
  • squid-cache squid 3.0.stable4
  • squid-cache squid 3.0.stable13
  • squid-cache squid 3.1.0.10
  • squid-cache squid 3.0.stable5
  • squid-cache squid 3.0.stable10
  • squid-cache squid 3.1.0.2
  • squid-cache squid 3.1.0.11
  • squid-cache squid 3.0.stable2
  • squid-cache squid 3.0.stable11
  • squid-cache squid 3.1.0.4
  • squid-cache squid 3.1.3
  • squid-cache squid 3.1.14
  • squid-cache squid 3.0.stable3
  • squid-cache squid 3.0.stable16
  • squid-cache squid 3.1.1
  • squid-cache squid 3.1.2
  • squid-cache squid 3.1.15
  • squid-cache squid 3.0.stable17
  • squid-cache squid 3.1.0.8
  • squid-cache squid 3.1.0.1
  • squid-cache squid 3.0.stable25
  • squid-cache squid 3.0.stable1
  • squid-cache squid 3.1
  • squid-cache squid 3.1.0.6
  • squid-cache squid 3.0.stable24
  • squid-cache squid 3.0.stable15
  • squid-cache squid 3.1.0.7
  • squid-cache squid 3.0.stable23
  • squid-cache squid 3.1.4
  • squid-cache squid 3.0.stable22
  • squid-cache squid 3.0.stable14
  • squid-cache squid 3.1.5
  • squid-cache squid 3.0.stable21
  • squid-cache squid 3.1.0.5
  • squid-cache squid 3.1.6
  • squid-cache squid 3.0.stable20
  • squid-cache squid 3.1.0.3
  • squid-cache squid 3.1.9
  • squid-cache squid 3.1.0.18
  • squid-cache squid 3.0.stable18
  • squid-cache squid 3.0
  • squid-cache squid 3.0.stable8
  • squid-cache squid 3.0.stable19
  • squid-cache squid 3.1.5.1
  • squid-cache squid 3.1.0.16
  • squid-cache squid 3.0.stable9
  • squid-cache squid 3.1.8
  • squid-cache squid 3.1.0.17
  • squid-cache squid 3.1.0.9
  • squid-cache squid 3.1.0.14
  • squid-cache squid 3.1.12
  • squid-cache squid 3.1.7

HTTP:LIBGD-GD2GETHEADER-IO - HTTP: GD Library libgd _gd2GetHeader Integer Overflow

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against libgd. A successful attack can lead to code execution.

Supported On:

isg-3.5.141652, idp-5.1.110161014, idp-4.1.110110719, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, idp-5.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, isg-3.5.0, isg-3.4.139899, j-series-9.5, srx-12.1, srx-branch-12.1, idp-4.2.110100823, idp-5.0.110130325, mx-11.4, isg-3.4.140032, idp-4.2.110101203, vsrx-12.1, idp-5.1.0, idp-5.0.110121210, vsrx-15.1, idp-4.1.110110609, isg-3.5.141597, idp-5.1.110160603

References:

  • url: https://bugs.php.net/bug.php?id=72339
  • url: https://libgd.github.io/release-2.2.3.html
  • cve: CVE-2016-5766

Affected Products:

  • redhat enterprise_linux 7.0
  • redhat enterprise_linux 6
  • debian debian_linux 8.0
  • freebsd 8.4
  • redhat openshift 2.0
  • freebsd 10.3
  • freebsd 10.1
  • freebsd 10.0
  • freebsd 9.0
  • freebsd 8.3
  • fedoraproject fedora 22
  • freebsd 9.1
  • freebsd 10.2
  • fedoraproject fedora 23
  • freebsd 9.2
  • fedoraproject fedora 24
  • freebsd 9.3
  • freebsd 8.2
  • freebsd 8.1
  • freebsd 8.0
  • redhat enterprise_linux 5
  • libgd 2.2.2

DNS:PDNS-AUTHSERV-DOS - DNS: PowerDNS Authoritative Server DNS Packet Processing Denial of Service

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against PowerDNS. A successful attack can result in a denial-of-service condition.

Supported On:

isg-3.5.141652, idp-5.1.110161014, idp-4.1.110110719, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, idp-5.0.0, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, isg-3.5.0, isg-3.4.139899, j-series-9.5, srx-12.1, srx-branch-12.1, idp-4.2.110100823, idp-5.0.110130325, mx-11.4, isg-3.4.140032, idp-4.2.110101203, vsrx-12.1, idp-5.1.0, idp-5.0.110121210, vsrx-15.1, idp-4.1.110110609, isg-3.5.141597, idp-5.1.110160603

References:

  • bugtraq: 77522
  • url: https://doc.powerdns.com/md/security/powerdns-advisory-2015-03/
  • cve: CVE-2015-5311
  • url: http://securitytracker.com/id?1034098

Affected Products:

  • powerdns authoritative 3.4.6
  • powerdns authoritative 3.4.5
  • powerdns authoritative 3.4.4

HTTP:STC:ACTIVEX:CVE-2017-0022 - HTTP: Microsoft XML Core Services CVE-2017-0022 Unsafe ActiveX Control

Severity: MEDIUM

Description:

This signature detects attempts to use an unsafe ActiveX control in Microsoft XML Core Services. An attacker can create a malicious Web site containing Web pages with dangerous ActiveX controls, which if accessed by a victim, allows the attacker to gain control of the victim's client browser.

Supported On:

isg-3.5.141652, idp-5.1.110161014, idp-4.1.110110719, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, idp-5.0.0, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, isg-3.5.0, isg-3.4.139899, j-series-9.5, srx-12.1, srx-branch-12.1, idp-4.2.110100823, idp-5.0.110130325, mx-11.4, isg-3.4.140032, idp-4.2.110101203, vsrx-12.1, idp-5.1.0, idp-5.0.110121210, vsrx-15.1, idp-4.1.110110609, isg-3.5.141597, idp-5.1.110160603

References:

  • cve: CVE-2017-0022

HTTP:STC:DL:SYM-AV-RAR-BO - HTTP: Symantec AntiVirus RAR Archive Decompression Buffer Overflow

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability in Symantec AntiVirus. A successful attack could allow the attacker to execute arbitrary code on the targeted system. Failed exploit attempts could result in a denial of service condition.

Supported On:

isg-3.5.141652, idp-5.1.110161014, idp-4.1.110110719, idp-4.0.0, mx-11.4, isg-3.4.140032, idp-4.1.0, mx-16.1, idp-4.2.0, idp-5.0.0, isg-3.5.0, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, idp-4.0.110090831, isg-3.4.139899, j-series-9.5, srx-12.1, srx-branch-12.1, idp-4.2.110100823, idp-5.0.110130325, idp-4.0.110090709, idp-4.2.110101203, vsrx-12.1, idp-5.1.0, idp-5.0.110121210, vsrx-15.1, idp-4.1.110110609, isg-3.5.141597, idp-5.1.110160603

References:

  • cve: CVE-2005-4438
  • bugtraq: 15971
  • url: http://www.kb.cert.org/vuls/id/305272

Affected Products:

  • Symantec AntiVirus Scan Engine for ISA 4.3.0
  • Symantec AntiVirus Scan Engine for Netapp Filer 4.0.0
  • Symantec AntiVirus Scan Engine for Netapp Filer 4.3.0
  • Symantec Norton AntiVirus for MS Exchange 2.1.0
  • Symantec AntiVirus Scan Engine for Netapp NetCache 4.0.0
  • Symantec AntiVirus Scan Engine for Bluecoat 4.0.0
  • Symantec Norton AntiVirus 2001 Professional Edition
  • Symantec Norton AntiVirus 2002 Professional Edition
  • Symantec Norton AntiVirus 2003 Professional Edition
  • Symantec Norton AntiVirus 2004 Professional Edition
  • Symantec Norton Internet Security 2001 Professional Edition
  • Symantec AntiVirus for SMTP 3.1.0 build 3.1.3
  • Symantec AntiVirus for SMTP 3.1.0 build 3.1.4
  • Symantec AntiVirus for SMTP 3.1.0 build 3.1.5
  • Symantec AntiVirus for SMTP 3.1.0 build 3.1.6
  • Symantec Web Security 3.0.1 build 3.01.59
  • Symantec Web Security 3.0.1 build 3.01.60
  • Symantec Web Security 3.0.1 build 3.01.61
  • Symantec Web Security 3.0.1 build 3.01.62
  • Symantec AntiVirus Scan Engine for Netapp NetCache 4.3.0
  • Symantec Web Security 3.0.1 build 3.01.67
  • Symantec Web Security 3.0.1 build 3.01.68
  • Symantec Enterprise Firewall 8.0.0
  • Symantec Web Security 3.0.1
  • Symantec Web Security 3.0.1 Build 62
  • Symantec Clientless VPN Gateway 4400 Series 5.0.0
  • Symantec AntiVirus Scan Engine for Caching 4.3.0
  • Symantec Mail Security for Microsoft Exchange 4.0.0 build 736
  • Symantec Mail Security for Microsoft Exchange 4.0.0 build 741
  • Symantec Mail Security for Microsoft Exchange 4.0.0 build 743
  • Symantec Mail Security for Domino 4.0.0
  • Symantec AntiVirus/Filtering for Domino Ports 3.0.0 (S390)
  • Symantec Gateway Security 5000 Series 3.0.0
  • Symantec AntiVirus for SMTP 3.1.0 build 3.1.2
  • Symantec AntiVirus Scan Engine 4.3.0 build 4.3.3
  • Symantec AntiVirus Scan Engine for ISA 4.3.0 build 4.3.3
  • Symantec AntiVirus Scan Engine for Netapp Filer 4.3.0 build 4.3.3
  • Symantec AntiVirus Scan Engine for Netapp NetCache 4.3.0 build 4.3.3
  • Symantec AntiVirus Scan Engine for Microsoft Portal 4.3.0
  • Symantec AntiVirus Scan Engine for Bluecoat 4.3.0 build 4.3.3
  • Symantec AntiVirus Scan Engine for Filers 4.3.0 build 4.3.3
  • Symantec Norton Internet Security 2006 Professional Edition
  • Symantec Web Security 3.0.1 build 3.0.1.70
  • Symantec Gateway Security 5200 1.0.0
  • Symantec Gateway Security 5300
  • Symantec Norton AntiVirus for MS Exchange 2.18.88
  • Symantec Norton Antivirus 2003
  • Symantec Norton Antivirus 7.0 for Macintosh
  • Symantec Norton System Works 2006
  • Symantec Gateway Security 5400 2.0.0
  • Symantec Norton Personal Firewall 2006
  • Symantec Norton Antivirus for Macintosh 9.0.1
  • Symantec Norton Antivirus for Macintosh 9.0.2
  • Symantec Norton Antivirus for Macintosh 10.0.0 .0
  • Symantec Norton Antivirus for Macintosh 10.0.1
  • Symantec Norton Personal Firewall 2005
  • Symantec Gateway Security 300 2.0.0
  • Symantec Norton Antivirus for Macintosh 10.9.1
  • Symantec Norton AntiVirus for MS Exchange 2.5.0
  • Symantec Norton Personal Firewall for Macintosh 3.1.0
  • Symantec Web Security 3.0.1 build 3.01.63
  • Symantec Norton AntiVirus 2006
  • Symantec Gateway Security 5440
  • Symantec AntiVirus Scan Engine 4.3.12
  • Symantec AntiVirus Scan Engine for Bluecoat 4.3.12
  • Symantec AntiVirus Scan Engine for Caching 4.3.12
  • Symantec AntiVirus Scan Engine for ISA 4.3.12
  • Symantec AntiVirus Scan Engine for Netapp Filer 4.3.12
  • Symantec Norton System Works 2005 Premier
  • Symantec AntiVirus Scan Engine 4.1.0
  • Symantec AntiVirus Scan Engine for Messaging 4.3.12
  • Symantec AntiVirus Scan Engine for Microsoft SharePoint 4.3.12
  • Symantec AntiVirus Scan Engine for Clearswift 4.3.12
  • Symantec AntiVirus Scan Engine for Bluecoat 4.3.0
  • Symantec AntiVirus Scan Engine for Clearswift 4.0.0
  • Symantec I-Gear MS Proxy 3.5.0
  • Symantec AntiVirus Scan Engine for Network Attached Storage 4.3.12
  • Symantec Norton Personal Firewall 2004
  • Symantec Mail Security for Microsoft Exchange 4.0.0
  • Symantec Mail Security for Microsoft Exchange 4.5.0
  • Symantec AntiVirus Corporate Edition 10.0.0
  • Symantec Mail Security for Domino 4.0.0 build 4.0.1
  • Symantec AntiVirus Scan Engine 4.3.0
  • Symantec AntiVirus for SMTP 3.1.0
  • Symantec Mail Security for SMTP 4.0.0
  • Symantec Brightmail Anti-Spam 4.0.0
  • Symantec Brightmail Anti-Spam 5.5.0
  • Symantec Norton Antivirus 2004 for Macintosh
  • Symantec AntiVirus Scan Engine for Filers 4.3.0
  • Symantec Norton System Works 2004 for Macintosh
  • Symantec Norton Antivirus 9.0 for Macintosh
  • Symantec Norton Internet Security for Macintosh 3.0
  • Symantec Norton System Works for Macintosh 3.0
  • Symantec AntiVirus Scan Engine 4.3.3
  • Symantec AntiVirus Scan Engine 4.3.0 build 4.3.7.27
  • Symantec Norton AntiVirus 2002
  • Symantec Norton AntiVirus Corporate Edition 7.51.0
  • Symantec Norton AntiVirus Corporate Edition 7.6.0
  • Symantec Norton AntiVirus Corporate Edition 7.5.0
  • Symantec Mail Security for SMTP 4.0.0 build 4.1.4.30
  • Symantec Norton AntiVirus 2005
  • Symantec AntiVirus for SMTP 3.1.0 build 3.1.1
  • Symantec Norton Internet Security 2003
  • Symantec Norton Internet Security 2005 Professional Edition
  • Symantec Brightmail Anti-Spam 6.0.0
  • Symantec AntiVirus for Handhelds 3.0.0 .0.194
  • Symantec Norton Internet Security 2002
  • Symantec Norton Internet Security 2002 Professional Edition
  • Symantec Firewall/VPN Appliance 100
  • Symantec Firewall/VPN Appliance 200
  • Symantec Mail Security for Domino 4.1.4
  • Symantec AntiVirus Scan Engine 4.0.0
  • Symantec Norton Antivirus 8.0 for Macintosh
  • Symantec Norton Internet Security for Macintosh 2.0
  • Symantec Norton System Works 7.0 for Macintosh
  • Symantec Norton AntiVirus for MS Exchange 2.18.85
  • Symantec Norton AntiVirus for MS Exchange 2.18.82
  • Symantec Mail Security for Microsoft Exchange 4.0.0 build 456
  • Symantec Mail Security for Microsoft Exchange 4.0.0 build 463
  • Symantec Mail Security for Microsoft Exchange 4.0.0 build 465
  • Symantec Mail Security for Microsoft Exchange 4.5.0 build 736
  • Symantec Mail Security for Microsoft Exchange 4.5.0 build 741
  • Symantec Mail Security for Microsoft Exchange 4.5.0 build 743
  • Symantec Mail Security for Microsoft Exchange 4.6.0 build 97
  • Symantec Norton AntiVirus 2005 11.0.0
  • Symantec Norton AntiVirus 2005 11.0.9
  • Symantec Mail Security for Domino 4.0.1
  • Symantec Mail Security for Domino 4.1.0
  • Symantec Norton System Works 2005 11.0.0
  • Symantec Norton System Works 2005 11.0.9
  • Symantec Web Security 3.0.1 build 3.0.1.74
  • Symantec Mail Security for SMTP 4.0.0 build 4.0.5.66
  • Symantec AntiVirus Scan Engine for Clearswift 4.3.0
  • Symantec AntiVirus/Filtering for Domino Ports 3.0.11
  • Symantec AntiSpam for SMTP 3.1.0
  • Symantec Mail Security for SMTP 4.1.0
  • Symantec Web Security 3.0.1 .70
  • Symantec AntiVirus/Filtering for Domino NT 3.1.1
  • Symantec Norton AntiVirus 2001
  • Symantec Client Security for Nokia Communicator
  • Symantec Norton System Works 2005 Premier
  • Symantec Norton AntiVirus 2005 Professional Edition
  • Symantec Norton Antivirus for Macintosh 9.0.0 .0
  • Symantec AntiVirus Scan Engine 4.1.8
  • Symantec Enterprise Firewall 8.0.0 Solaris
  • Symantec Enterprise Firewall 8.0.0 NT/2000
  • Symantec Norton AntiVirus Corporate Edition 7.60.build 926
  • Symantec Gateway Security 5300 1.0.0
  • Symantec Norton AntiVirus for MS Exchange 2.0.0
  • Symantec Antivirus for MS Office SharePoint Portal Server 2003
  • Symantec AntiVirus Scan Engine 4.3.0 build 4.3.8.29
  • Symantec AntiVirus for SMTP 3.1.7
  • Symantec AntiVirus for SMTP 4.1.9
  • Symantec Mail Security for SMTP 4.0.2
  • Symantec Norton AntiVirus Corporate Edition 7.0.0
  • Symantec Norton AntiVirus Corporate Edition 7.2.0
  • Symantec Norton AntiVirus Corporate Edition 8.0.0
  • Symantec Norton Antivirus for Macintosh 9.0.3
  • Symantec Mail Security for Microsoft Exchange 4.5.0 build 4.5.4.743
  • Symantec Norton AntiVirus for MS Exchange 1.5.0
  • Symantec Brightmail Anti-Spam 6.0.1
  • Symantec Mail Security for Microsoft Exchange 4.6.0 build 4.6.1.107
  • Symantec Gateway Security 1.0.0
  • Symantec Norton AntiVirus Corporate Edition 7.61.0
  • Symantec AntiVirus/Filtering for Domino NT 3.1.0
  • Symantec AntiVirus for Handhelds Corporate Edition 3.0.0
  • Symantec Client Security 3.0.0
  • Symantec AntiVirus/Filtering for Domino Ports 3.0.0
  • Symantec Mail Security for Microsoft Exchange 5.0.0
  • Symantec Norton Internet Security 2001
  • Symantec Mail Security for SMTP 4.0.0 build 4.0.2
  • Symantec Gateway Security 5310 1.0.0
  • Symantec Web Security 3.0.1 build 3.0.1.72
  • Symantec Gateway Security 5400 2.0.1
  • Symantec Norton Antivirus for Macintosh Corporate Edition 9.0.0
  • Symantec Norton AntiVirus 2004
  • Symantec Brightmail Anti-Spam 6.0.2
  • Symantec AntiVirus Scan Engine for Netapp NetCache 4.3.12
  • Symantec AntiVirus Scan Engine 5.0.1
  • Symantec Norton AntiVirus for Internet Email Gateways 1.0.0
  • Symantec Gateway Security 400 2.0.0
  • Symantec Mail Security for Microsoft Exchange 4.6.3
  • Symantec AntiVirus for Handhelds 3.0.0
  • Symantec AntiVirus for SMTP 4.0.0
  • Symantec Norton AntiVirus for Microsoft Exchange 2.18.0 build 83
  • Symantec Norton SystemWorks 2004
  • Symantec Norton SystemWorks 2004 Professional Edition
  • Symantec Mail Security for Microsoft Exchange 4.5.0 build 719
  • Symantec AntiVirus/Filtering for Domino NT 3.1.0 build 3.1.1
  • Symantec Norton Internet Security 2004 Professional Edition
  • Symantec AntiVirus/Filtering for Domino Ports 3.0.0 (AIX) build 3.0.5
  • Symantec AntiVirus/Filtering for Domino Ports 3.0.0 (OS400) build 3.0.5
  • Symantec AntiVirus/Filtering for Domino Ports 3.0.0 (Linux) build 3.0.5
  • Symantec AntiVirus/Filtering for Domino Ports 3.0.0 (Solaris)build 3.0.5

HTTP:STC:DL:CVE-2017-0014-RCE - HTTP: Microsoft Office CVE-2017-0014 Remote Code Execution

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Microsoft Office. Successful exploitation can lead to Remote Code Execution.

Supported On:

isg-3.5.141652, idp-5.1.110161014, idp-4.1.110110719, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, idp-5.0.0, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, isg-3.5.0, isg-3.4.139899, j-series-9.5, srx-12.1, srx-branch-12.1, idp-4.2.110100823, idp-5.0.110130325, mx-11.4, isg-3.4.140032, idp-4.2.110101203, vsrx-12.1, idp-5.1.0, idp-5.0.110121210, vsrx-15.1, idp-4.1.110110609, isg-3.5.141597, idp-5.1.110160603

References:

  • cve: CVE-2017-0014

HTTP:STC:IE:CVE-2017-0023-RCE - HTTP: Microsoft Edge CVE-2017-0023 Remote Code Execution

Severity: HIGH

Description:

This signature detects an attempt to exploit a known vulnerability against Microsoft Edge. Successful exploitation of this issue may grant an attacker remote code execution.

Supported On:

srx-branch-12.1, isg-3.5.141652, mx-11.4, idp-5.1.110161014, idp-4.1.0, mx-16.1, vsrx-12.1, vsrx-15.1, idp-5.1.110160603, j-series-9.5, isg-3.5.141597, srx-12.1

References:

  • cve: CVE-2017-0023

APP:LINUX-KERNEL-SCTP-OOB - APP: Linux Kernel SCTP sctp_sf_ootb Out of Bounds Read

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability in the SCTP networking module of the Linux kernel. A successful exploitation could result in denial of service conditions.

Supported On:

idp-5.1.110161014, idp-4.1.110110719, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, idp-5.0.0, j-series-9.5, srx-12.1, srx-branch-12.1, idp-4.2.110100823, idp-5.0.110130325, mx-11.4, idp-4.2.110101203, vsrx-12.1, idp-5.1.0, idp-5.0.110121210, vsrx-15.1, idp-4.1.110110609, idp-5.1.110160603

References:

  • cve: CVE-2016-9555

Affected Products:

  • linux linux_kernel 4.8.7

APP:IBM:TIVOLI-STORAGE-MGR-BOF - APP: Tivoli Storage Manager Buffer Overflow

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Tivoli Storage Manager. A successful attack can lead to arbitrary code execution.

Supported On:

isg-3.5.141652, idp-5.1.110161014, idp-4.1.110110719, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, idp-5.0.0, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, isg-3.5.0, isg-3.4.139899, j-series-9.5, srx-12.1, srx-branch-12.1, idp-4.2.110100823, idp-5.0.110130325, mx-11.4, isg-3.4.140032, idp-4.2.110101203, vsrx-12.1, idp-5.1.0, idp-5.0.110121210, vsrx-15.1, idp-4.1.110110609, isg-3.5.141597, idp-5.1.110160603

References:

  • bugtraq: 84161
  • cve: CVE-2015-8519

Affected Products:

  • ibm tivoli_storage_manager_fastback 6.1.4
  • ibm tivoli_storage_manager_fastback 6.1.12.1
  • ibm tivoli_storage_manager_fastback 6.1.5.2
  • ibm tivoli_storage_manager_fastback 6.1.6
  • ibm tivoli_storage_manager_fastback 6.1.0
  • ibm tivoli_storage_manager_fastback 6.1.1
  • ibm tivoli_storage_manager_fastback 6.1.4.0
  • ibm tivoli_storage_manager_fastback 6.1.1.0
  • ibm tivoli_storage_manager_fastback 6.1.3
  • ibm tivoli_storage_manager_fastback 6.1.7.2
  • ibm tivoli_storage_manager_fastback 6.1.2
  • ibm tivoli_storage_manager_fastback 6.1.7.0
  • ibm tivoli_storage_manager_fastback 6.1.8.0
  • ibm tivoli_storage_manager_fastback 6.1.0.1
  • ibm tivoli_storage_manager_fastback 6.1.3.0
  • ibm tivoli_storage_manager_fastback 6.1.7
  • ibm tivoli_storage_manager_fastback 6.1.7.1
  • ibm tivoli_storage_manager_fastback 6.1.11.0
  • ibm tivoli_storage_manager_fastback 6.1.11.1
  • ibm tivoli_storage_manager_fastback 6.1.2.0
  • ibm tivoli_storage_manager_fastback 6.1.6.2
  • ibm tivoli_storage_manager_fastback 6.1.12
  • ibm tivoli_storage_manager_fastback 6.1.6.1
  • ibm tivoli_storage_manager_fastback 6.1.11
  • ibm tivoli_storage_manager_fastback 6.1.6.0
  • ibm tivoli_storage_manager_fastback 6.1.10.1
  • ibm tivoli_storage_manager_fastback 6.1.9
  • ibm tivoli_storage_manager_fastback 6.1.10
  • ibm tivoli_storage_manager_fastback 6.1.10.0
  • ibm tivoli_storage_manager_fastback 6.1.8
  • ibm tivoli_storage_manager_fastback 5.5.0
  • ibm tivoli_storage_manager_fastback 6.1.5
  • ibm tivoli_storage_manager_fastback 6.1.9.0
  • ibm tivoli_storage_manager_fastback 6.1.5.0
  • ibm tivoli_storage_manager_fastback 6.1.9.1

HTTP:STC:DL:CVE-2015-3205-RCE - HTTP: Libmimedir VCF Memory Corruption

Severity: MEDIUM

Description:

This signature detects attempts to exploit a known vulnerability against Libmimedir. A successful attack can lead to arbitrary code execution.

Supported On:

isg-3.5.141652, idp-5.1.110161014, idp-4.1.110110719, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, idp-5.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, isg-3.5.0, isg-3.4.139899, j-series-9.5, srx-12.1, srx-branch-12.1, idp-4.2.110100823, idp-5.0.110130325, mx-11.4, isg-3.4.140032, idp-4.2.110101203, vsrx-12.1, idp-5.1.0, idp-5.0.110121210, vsrx-15.1, idp-4.1.110110609, isg-3.5.141597, idp-5.1.110160603

References:

  • bugtraq: 75147
  • cve: CVE-2015-3205

HTTP:STC:DL:CVE-2016-0954-RCE - HTTP: Adobe Digital Editions CVE-2016-0954 Critical Memory Corruption

Severity: MEDIUM

Description:

A critical memory corruption occurs when Adobe Digital Editions handle a specially crafted ExtGstate object, which could lead to remote code execution.

Supported On:

srx-branch-12.1, isg-3.5.141652, mx-11.4, idp-5.1.110161014, idp-4.1.0, mx-16.1, vsrx-12.1, vsrx-15.1, idp-5.1.110160603, j-series-9.5, isg-3.5.141597, srx-12.1

References:

  • bugtraq: 84214
  • cve: CVE-2016-0954

Affected Products:

  • adobe digital_editions 4.5.0

HTTP:STC:IE:OBJECT-PROCESING-CE - HTTP: Microsoft Internet Explorer Obeject Handling Remote Code Execution

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Microsoft Internet Explorer. A successful exploit can lead to remote code execution.

Supported On:

isg-3.5.141652, idp-5.1.110161014, idp-4.1.110110719, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, idp-5.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, isg-3.5.0, isg-3.4.139899, j-series-9.5, srx-12.1, srx-branch-12.1, idp-4.2.110100823, idp-5.0.110130325, mx-11.4, isg-3.4.140032, idp-4.2.110101203, vsrx-12.1, idp-5.1.0, idp-5.0.110121210, vsrx-15.1, idp-4.1.110110609, isg-3.5.141597, idp-5.1.110160603

References:

  • cve: CVE-2015-1752

Affected Products:

  • microsoft internet_explorer 9
  • microsoft internet_explorer 10
  • microsoft internet_explorer 11

HTTP:STC:IMG:PNG-CHUNK-OF-2 - HTTP: PNG Type Chunk Overflow (2)

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against libpng, a library for changing and displaying Portable Network Graphic (PNG) files. libpng v1.2.5 and earlier versions are vulnerable. Attackers can create PNG image files with malformed multiple content type chunks to overflow a buffer in libpng.

Supported On:

isg-3.5.141652, idp-5.1.110161014, idp-4.1.110110719, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, idp-5.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, isg-3.5.0, isg-3.4.139899, j-series-9.5, srx-12.1, srx-branch-12.1, idp-4.2.110100823, idp-5.0.110130325, mx-11.4, isg-3.4.140032, idp-4.2.110101203, vsrx-12.1, idp-5.1.0, idp-5.0.110121210, vsrx-15.1, idp-4.1.110110609, isg-3.5.141597, idp-5.1.110160603

References:

  • bugtraq: 18385
  • cve: CVE-2006-0025
  • cve: CVE-2004-0599
  • bugtraq: 10857
  • bugtraq: 55333
  • cve: CVE-2012-4170

Affected Products:

  • microsoft windows_media_player 10
  • microsoft windows_media_player 9

HTTP:EK-MUL-SUCCESSFUL-REDIR3 - HTTP: Multiple Exploit Kit Successful Redirection (3)

Severity: HIGH

Description:

This signature detects an attempt to download exploits from malicious exploit kits that may compromise a computer through various vendor vulnerabilities. Exploit kits are very specific type of toolkits which are being used by cybercriminals to deliver other pieces of malware.

Supported On:

isg-3.5.141652, idp-5.1.110161014, idp-4.1.110110719, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, idp-5.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, isg-3.5.0, isg-3.4.139899, j-series-9.5, srx-12.1, srx-branch-12.1, idp-4.2.110100823, idp-5.0.110130325, mx-11.4, isg-3.4.140032, idp-4.2.110101203, vsrx-12.1, idp-5.1.0, idp-5.0.110121210, vsrx-15.1, idp-4.1.110110609, isg-3.5.141597, idp-5.1.110160603

HTTP:STC:IMG:PNG-CHUNK-OF-1 - HTTP: PNG Type Chunk Overflow (1)

Severity: CRITICAL

Description:

This signature detects attempts to exploit a known vulnerability against libpng, a library for changing and displaying Portable Network Graphic (PNG) files. libpng v1.2.5 and earlier versions are vulnerable. Attackers can create PNG image files with malformed multiple content type chunks to overflow a buffer in libpng.

Supported On:

isg-3.5.141652, idp-5.1.110161014, idp-4.1.110110719, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, idp-5.0.0, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, isg-3.5.0, isg-3.4.139899, j-series-9.5, srx-12.1, srx-branch-12.1, idp-4.2.110100823, idp-5.0.110130325, mx-11.4, isg-3.4.140032, idp-4.2.110101203, vsrx-12.1, idp-5.1.0, idp-5.0.110121210, vsrx-15.1, idp-4.1.110110609, isg-3.5.141597, idp-5.1.110160603

References:

  • cve: CVE-2012-4170
  • bugtraq: 55333
  • bugtraq: 10857
  • cve: CVE-2004-0599
  • cve: CVE-2006-0025
  • bugtraq: 18385

Affected Products:

  • Mozilla Browser 1.3.1
  • Mozilla Browser 1.4.0 B
  • Trustix Secure Linux 2.0.0
  • SGI Advanced Linux Environment 3.0.0
  • Mandriva Linux Mandrake 9.1.0
  • Trustix Secure Linux 2.1.0
  • Mozilla Browser 1.4.0 A
  • Mandriva Linux Mandrake 9.1.0 Ppc
  • SuSE Linux 7.3.0
  • Microsoft Windows Messenger 5.0
  • Mandriva Linux Mandrake 10.0.0 amd64
  • SuSE Linux 7.1.0
  • ImageMagick 5.4.3
  • Gentoo Linux 1.4.0
  • SuSE Linux Personal 9.0.0 X86 64
  • libpng 1.0.12
  • Mozilla Browser 0.9.35
  • Mozilla Browser 0.9.48
  • Mozilla Browser 1.5.0
  • Red Hat Fedora Core1
  • Red Hat Desktop 3.0.0
  • Mandriva Linux Mandrake 10.0.0
  • Adobe SVG Viewer 3.0.0
  • Adobe SVG Viewer 3.0.0 1
  • Compaq Tru64 5.1.0 a PK6(BL24)
  • SuSE Linux 7.0.0 Alpha
  • SuSE Linux 7.1.0 ppc
  • SuSE Linux 7.0.0 ppc
  • Mozilla Browser 0.9.5
  • Mozilla Browser 0.9.4 .1
  • Mozilla Browser 0.9.4
  • Mozilla Browser 0.9.3
  • Turbolinux Turbolinux Server 7.0.0
  • Turbolinux Turbolinux Workstation 8.0.0
  • Turbolinux Turbolinux Workstation 7.0.0
  • Turbolinux Turbolinux Server 6.1.0
  • Turbolinux Turbolinux Advanced Server 6.0.0
  • Debian Linux 3.0.0 Sparc
  • SuSE SUSE Linux Enterprise Server 8
  • Conectiva Linux 9.0.0
  • HP Tru64 5.1.0 B
  • SuSE Linux 7.2.0
  • Mandriva Corporate Server 2.1.0
  • Mandriva Corporate Server 4.0.0 X86 64
  • Mozilla Browser 1.1.0
  • Mozilla Browser 1.4.0
  • Sun Solaris 9 Sparc
  • Mozilla Browser 1.1.0 Alpha
  • Mozilla Firebird 0.6.1
  • Debian Linux 3.0.0 Alpha
  • Debian Linux 3.0.0 Arm
  • Debian Linux 3.0.0 Ia-32
  • Debian Linux 3.0.0 Ia-64
  • Mozilla Browser 1.2.0 Alpha
  • Debian Linux 3.0.0 M68k
  • Debian Linux 3.0.0 Mips
  • Debian Linux 3.0.0 Mipsel
  • Debian Linux 3.0.0 Ppc
  • Debian Linux 3.0.0 S/390
  • Microsoft MSN Messenger Service 6.2
  • Mozilla Browser 1.3.0
  • Microsoft Windows Messenger 4.7.0.2009
  • Red Hat Linux 7.3.0 I386
  • Debian Linux 3.0.0
  • Mozilla Browser 1.4.2
  • Red Hat Linux 9.0.0 I386
  • Mandriva Linux Mandrake 9.2.0 amd64
  • SuSE Linux 7.0.0
  • HP Tru64 5.1.0 a PK4 (BL21)
  • libpng libpng3 1.2.5
  • SuSE Linux 7.2.0 i386
  • Microsoft MSN Messenger Service 6.1
  • Microsoft Windows XP 64-bit Edition Version 2003
  • Mandriva Multi Network Firewall 2.0.0
  • Mozilla Browser 1.2.0 Beta
  • Mozilla Browser 1.0.1
  • Mandriva Corporate Server 3.0.0 X86 64
  • SuSE Linux 7.3.0 ppc
  • Mozilla Browser 1.2.1
  • Turbolinux Appliance Server Hosting Edition 1.0.0
  • Turbolinux Appliance Server Workgroup Edition 1.0.0
  • Microsoft Windows XP Home SP1
  • Microsoft Windows XP Professional SP1
  • Mandriva Linux Mandrake 2006.0.0
  • Mandriva Linux Mandrake 2006.0.0 X86 64
  • SuSE Linux Personal 8.2.0
  • Red Hat Enterprise Linux AS 2.1
  • Red Hat Enterprise Linux ES 2.1
  • Turbolinux Turbolinux Desktop 10.0.0
  • Red Hat Linux Advanced Work Station 2.1.0
  • Apple Mac OS X 10.3.4
  • Apple Mac OS X Server 10.3.4
  • Mandriva Corporate Server 2.1.0 X86 64
  • OpenPKG Current
  • Microsoft Windows XP Tablet PC Edition SP1
  • libpng 1.0.10
  • libpng 1.0.0
  • SuSE Linux 7.1.0 x86
  • SuSE Linux 7.1.0 Alpha
  • Mandriva Linux Mandrake 2007.0 X86 64
  • Red Hat Enterprise Linux AS 3
  • Red Hat Enterprise Linux ES 3
  • Red Hat Enterprise Linux WS 3
  • Mozilla Browser 0.9.8
  • Mozilla Browser 1.2.0
  • Sun Solaris 8 Sparc
  • Sun Solaris 8 X86
  • SuSE Linux Personal 9.1.0
  • SuSE Linux 7.0.0 i386
  • Mozilla Browser 1.0.2
  • SuSE Linux 7.3.0 i386
  • SuSE Linux 7.3.0 sparc
  • Mozilla Browser 1.0.0
  • Sun Solaris 1.1.4-JL
  • Mozilla Browser 1.4.1
  • Mozilla Browser 0.8.0
  • Mandriva Corporate Server 4.0
  • Mandriva Linux Mandrake 2007.0
  • Debian Linux 3.0.0 Hppa
  • Mandriva Corporate Server 3.0.0
  • SuSE Linux Desktop 1.0.0
  • OpenPKG 2.1.0
  • Trustix Secure Enterprise Linux 2.0.0
  • SuSE Linux 8.1.0
  • ImageMagick 5.4.4 .5
  • SCO Unixware 7.1.4
  • libpng libpng3 1.2.4
  • Mozilla Browser 1.7.0
  • libpng libpng3 1.2.3
  • libpng libpng3 1.2.2
  • libpng 1.0.13
  • libpng libpng3 1.2.1
  • libpng libpng3 1.2.0 .0
  • libpng 1.0.9
  • libpng 1.0.8
  • libpng 1.0.7
  • libpng 1.0.6
  • libpng 1.0.5
  • Compaq Tru64 5.1.0 b PK3(BL24)
  • libpng 1.0.11
  • Conectiva Linux 8.0.0
  • Red Hat Linux 7.3.0
  • Mozilla Browser 1.7.1
  • Mozilla Firefox 0.9.2
  • Mozilla Thunderbird 0.7.2
  • Microsoft Windows Messenger 4.7.0.3000
  • GraphicsMagick 1.0.0
  • GraphicsMagick 1.1.0
  • GraphicsMagick 1.0.6
  • Compaq Tru64 5.1.0 b PK4 (BL25)
  • Sun Java Desktop System (JDS) 1.0.0
  • Sun Java Desktop System (JDS) 2.0.0
  • Microsoft Windows XP Media Center Edition SP1
  • Turbolinux Turbolinux Server 6.5.0
  • Mozilla Firefox 0.9.0
  • Mozilla Firefox 0.9.1
  • Adobe SVG Viewer 3.0.0 2
  • Mozilla Browser 1.1.0 Beta
  • OpenPKG 2.0.0
  • Mozilla Thunderbird 0.7.1
  • Mozilla Browser 0.9.9
  • Mozilla Browser 1.0.0 RC1
  • libpng 1.0.14
  • Mozilla Browser 0.9.2
  • Red Hat Enterprise Linux WS 2.1
  • Avaya Network Routing
  • Nortel Networks IP softphone 2050
  • Nortel Networks Mobile Voice Client 2050
  • Nortel Networks Symposium Call Center Server (SCCS)
  • Sun Solaris 9 X86
  • Nortel Networks Optivity Telephony Manager (OTM)
  • SuSE Linux 8.0.0
  • SuSE Linux 8.0.0 i386
  • Apple Mac OS X Server 10.2.8
  • Apple Mac OS X 10.2.8
  • SuSE Linux 7.0.0 sparc
  • Gentoo Linux 1.2.0
  • SuSE Linux Personal 9.0.0
  • Mozilla Firebird 0.7.0
  • Mandriva Linux Mandrake 9.2.0
  • Mozilla Browser 0.9.6
  • Microsoft Windows XP 64-bit Edition Version 2003 SP1
  • Netscape Communicator 7.0
  • SuSE Linux 7.1.0 sparc
  • Mozilla Firebird 0.5.0
  • Conectiva Linux 10.0.0
  • Mozilla Firefox 0.8.0
  • Mozilla Browser 0.9.7
  • Turbolinux Turbolinux Workstation 6.0.0
  • Red Hat Fedora Core2
  • Mozilla Browser 1.0.0 RC2
  • Mozilla Browser 1.6.0
  • Mozilla Browser 1.7.0 Rc3
  • Mozilla Firefox 0.9.0 Rc
  • Red Hat Linux 7.3.0 I686
  • Mozilla Thunderbird 0.7.0
  • Turbolinux Turbolinux Server 8.0.0
  • ImageMagick 5.4.8 .2-1.1.0
  • ImageMagick 5.5.3 .2-1.2.0
  • ImageMagick 5.5.6 .0-20030409
  • Mozilla Browser 0.9.2 .1

HTTP:SUSP-HDR-REDRCT-EXP-131 - HTTP:SUSP-HDR-REDRCT Infection-131

Severity: MEDIUM

Description:

This signature detects an attempt to download exploits from malicious exploit kits that may compromise a computer through various vendor vulnerabilities. Exploit kits are very specific type of toolkits which are being used by cybercriminals to deliver other pieces of malware.

Supported On:

isg-3.5.141652, idp-5.1.110161014, idp-4.1.110110719, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, idp-5.0.0, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, isg-3.5.0, isg-3.4.139899, j-series-9.5, srx-12.1, srx-branch-12.1, idp-4.2.110100823, idp-5.0.110130325, mx-11.4, isg-3.4.140032, idp-4.2.110101203, vsrx-12.1, idp-5.1.0, idp-5.0.110121210, vsrx-15.1, idp-4.1.110110609, isg-3.5.141597, idp-5.1.110160603

HTTP:SYMC-DCS-CVE-2014-9225-ID - HTTP: Symantec Data Center Security CVE-2014-9225 Information Disclosure

Severity: MEDIUM

Description:

This signature detects attempts to exploit a known vulnerability against Symantec Data Center Security. Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks.

Supported On:

isg-3.5.141652, idp-5.1.110161014, idp-4.1.110110719, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, idp-5.0.0, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, isg-3.5.0, isg-3.4.139899, j-series-9.5, srx-12.1, srx-branch-12.1, idp-4.2.110100823, idp-5.0.110130325, mx-11.4, isg-3.4.140032, idp-4.2.110101203, vsrx-12.1, idp-5.1.0, idp-5.0.110121210, vsrx-15.1, idp-4.1.110110609, isg-3.5.141597, idp-5.1.110160603

References:

  • bugtraq: 72094
  • cve: CVE-2014-9225

HTTP:EXT:FILE-EXT-IN-DIR - HTTP: File Extension in Directory Name

Severity: MEDIUM

Description:

This signature detects HTTP requests that contain a well-known internet file extension being used as a directory. Attackers can use these HTTP requests to hide malicious content in a benign file format. For example, an attacker can disguise a link to a directory containing a malicious HTML file as a link to an image file.

Supported On:

isg-3.5.141652, idp-5.1.110161014, idp-4.1.110110719, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, idp-5.0.0, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, isg-3.5.0, isg-3.4.139899, j-series-9.5, srx-12.1, srx-branch-12.1, idp-4.2.110100823, idp-5.0.110130325, mx-11.4, isg-3.4.140032, idp-4.2.110101203, vsrx-12.1, idp-5.1.0, idp-5.0.110121210, vsrx-15.1, idp-4.1.110110609, isg-3.5.141597, idp-5.1.110160603

References:

  • url: http://www.juniper.net/security/auto/vulnerabilities/vuln345.html

HTTP:EK-MUL-SUCCESSFUL-REDIR2 - HTTP: Multiple Exploit Kit Successful Redirection (2)

Severity: HIGH

Description:

This signature detects an attempt to download exploits from malicious exploit kits that may compromise a computer through various vendor vulnerabilities. Exploit kits are very specific type of toolkits which are being used by cybercriminals to deliver other pieces of malware.

Supported On:

isg-3.5.141652, idp-5.1.110161014, idp-4.1.110110719, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, idp-5.0.0, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, isg-3.5.0, isg-3.4.139899, j-series-9.5, srx-12.1, srx-branch-12.1, idp-4.2.110100823, idp-5.0.110130325, mx-11.4, isg-3.4.140032, idp-4.2.110101203, vsrx-12.1, idp-5.1.0, idp-5.0.110121210, vsrx-15.1, idp-4.1.110110609, isg-3.5.141597, idp-5.1.110160603

APP:PROXY:SQUID-PROXY-CACHE - APP: Squid Proxy Cache cachemgr.cgi Resource Exhaustion

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Squid Proxy Cache. A successful attack can result in a denial-of-service condition.

Supported On:

isg-3.5.141652, idp-5.1.110161014, idp-4.1.110110719, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, idp-5.0.0, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, isg-3.5.0, isg-3.4.139899, j-series-9.5, srx-12.1, srx-branch-12.1, idp-4.2.110100823, idp-5.0.110130325, mx-11.4, isg-3.4.140032, idp-4.2.110101203, vsrx-12.1, idp-5.1.0, idp-5.0.110121210, vsrx-15.1, idp-4.1.110110609, isg-3.5.141597, idp-5.1.110160603

References:

  • cve: CVE-2012-5643

Affected Products:

  • squid-cache squid 3.2.0.5
  • squid-cache squid 3.1.0.17
  • squid-cache squid 3.2.0.15
  • squid-cache squid 3.2.0.3
  • squid-cache squid 3.0.stable19
  • squid-cache squid 3.2.0.17
  • squid-cache squid 3.2.0.1
  • squid-cache squid 3.1.19
  • squid-cache squid 3.0 (-:pre4)
  • squid-cache squid 3.2.0.11
  • squid-cache squid 3.1.0.5
  • squid-cache squid 3.2.0.13
  • squid-cache squid 3.1.0.7
  • squid-cache squid 3.1
  • squid-cache squid 3.1.0.1
  • squid-cache squid 3.1.0.2
  • squid-cache squid 3.2.0.9
  • squid-cache squid 3.1.0.3
  • squid-cache squid 3.0 (-:pre2)
  • squid-cache squid 3.2.3
  • squid-cache squid 3.2.1
  • squid-cache squid 2.4
  • squid-cache squid 3.1.0.9
  • squid-cache squid 3.0 (-:pre7)
  • squid-cache squid 2.6
  • squid-cache squid 3.0.stable8
  • squid-cache squid 2.0
  • squid-cache squid 3.0.stable11 (rc1)
  • squid-cache squid 3.0.stable20
  • squid-cache squid 2.2
  • squid-cache squid 3.0.stable22
  • squid-cache squid 3.0.stable24
  • squid-cache squid 3.0.stable14
  • squid-cache squid 3.1.14
  • squid-cache squid 3.0.stable2
  • squid-cache squid 3.0.stable10
  • squid-cache squid 2.7 (stable4)
  • squid-cache squid 3.1.16
  • squid-cache squid 3.1.0.10
  • squid-cache squid 3.0.stable4
  • squid-cache squid 3.2.0.18
  • squid-cache squid 3.2.0.6
  • squid-cache squid 3.0.stable12
  • squid-cache squid 3.1.10
  • squid-cache squid 3.1.0.12
  • squid-cache squid 3.0.stable6
  • squid-cache squid 3.3.0.1
  • squid-cache squid 3.1.21
  • squid-cache squid 3.0 (-:pre5)
  • squid-cache squid 3.2.0.4
  • squid-cache squid 3.0 (-:pre3)
  • squid-cache squid 3.1.12
  • squid-cache squid 3.1.0.14
  • squid-cache squid 3.2.0.14
  • squid-cache squid 3.2.0.2
  • squid-cache squid 3.0 (-:pre6)
  • squid-cache squid 3.1.0.16
  • squid-cache squid 3.2.0.16
  • squid-cache squid 3.0.stable18
  • squid-cache squid 3.1.0.18
  • squid-cache squid 3.2.0.10
  • squid-cache squid 3.1.18
  • squid-cache squid 3.2.0.12
  • squid-cache squid 3.1.0.4
  • squid-cache squid 3.1.0.6
  • squid-cache squid 3.0.stable16 (rc1)
  • squid-cache squid 2.7 (stable3)
  • squid-cache squid 3.2.2
  • squid-cache squid 3.1.2
  • squid-cache squid 3.0 (-:pre1)
  • squid-cache squid 2.5
  • squid-cache squid 3.1.0.8
  • squid-cache squid 3.0.stable9
  • squid-cache squid 2.1
  • squid-cache squid 2.3
  • squid-cache squid 3.0.stable21
  • squid-cache squid 3.0 (rc4)
  • squid-cache squid 3.0.stable23
  • squid-cache squid 3.0.stable15
  • squid-cache squid 3.0.stable1
  • squid-cache squid 3.0.stable25
  • squid-cache squid 3.0.stable17
  • squid-cache squid 3.1.15
  • squid-cache squid 3.1.1
  • squid-cache squid 3.2.0.7
  • squid-cache squid 3.0.stable3
  • squid-cache squid 3.1.17
  • squid-cache squid 3.1.0.11
  • squid-cache squid 3.0.stable5
  • squid-cache squid 3.0.stable13
  • squid-cache squid 3.1.11
  • squid-cache squid 3.1.0.13
  • squid-cache squid 3.0.stable7
  • squid-cache squid 3.2.0.19
  • squid-cache squid 3.1.20
  • squid-cache squid 3.2.0.8
  • squid-cache squid 3.1.13
  • squid-cache squid 3.1.0.15
Site Map
RSS Feeds
Careers
Accessibility
Feedback
Privacy Policy
Legal Notices
Copyright © 1999-2010 Juniper Networks, Inc. All rights reserved.
Help
|
My Account
|
Log Out