Update Details

Update #2997 (10/10/2017)

17 new signatures:

HIGH	HTTP:STC:IE:CVE-2017-11798-MC	HTTP: Microsoft Edge Scripting Engine CVE-2017-11798 Memory Corruption
HIGH	APP:MISC:SWAGGER-CODEGEN-PI	APP: JSON Swagger CodeGen Parameter Injector
HIGH	HTTP:STC:DL:CVE-2017-11763-RCE	HTTP: Microsoft Graphics CVE-2017-11763 Remote Code Execution
HIGH	HTTP:STC:DL:CVE-2017-11762-RCE	HTTP: Microsoft Graphics CVE-2017-11762 Remote Code Execution
HIGH	HTTP:APACHE:TOMCAT-PUT-RCE	HTTP: Apache Tomcat HTTP PUT Windows Remote Code Execution
MEDIUM	SSL:TREND-MICRO-MSE-SQLI	SSL: Trend Micro Mobile Security Enterprise eas_agent_unregister slink_id SQL Injection
HIGH	HTTP:STC:IE:CVE-2017-11800-RCE	HTTP: Microsoft Internet Explorer CVE-2017-11800 Remote Code Execution
HIGH	IMAP:OVERFLOW:MAILENABLE-LOGIN	IMAP: MailEnable IMAPD (2.34/2.35) Login Request Buffer Overflow
HIGH	HTTP:MISC:TREND-MICRO-MSE-SQLI	HTTP: Trend Micro Mobile Security Enterprise eas_agent_unregister slink_id SQL Injection
HIGH	HTTP:STC:IE:CVE-2017-11793-CE	HTTP: Microsoft Internet Explorer CVE-2017-11793 Remote Code Execution
HIGH	CHAT:IRC:BOTNET:XDH-IRC-RCE	CHAT: Xdh / LinuxNet Perlbot / fBot IRC Bot Remote Code Execution
HIGH	HTTP:STC:IE:CVE-2017-11822-MC	HTTP: Microsoft Internet Explorer CVE-2017-11822 Memory Corruption
HIGH	HTTP:MISC:FOREMAN-BOOKMARKS-RCE	HTTP: Foreman bookmarks_controller.rb Remote Code Execution
HIGH	HTTP:STC:IE:CVE-2017-11810-MC	HTTP: Microsoft Internet Explorer CVE-2017-11810 Memory Corruption
HIGH	HTTP:STC:IE:CVE-2017-8727-MC	HTTP: Microsoft Internet Explorer CVE-2017-8727 Memory Corruption
HIGH	HTTP:STC:DL:CVE-2017-8689-EOP	HTTP: Microsoft Windows CVE-2017-8689 Elevation Of Privileges
HIGH	HTTP:STC:IE:CVE-2017-8694-EOP	HTTP: Windows Kernel-Mode Driver CVE-2017-8694 Elevation of Privileges

2 updated signatures:

HIGH	APP:SNORT:BACKORIFICE-DOS	APP: Snort BackOrifice Preprocessor Denial of Service
HIGH	APP:MISC:ALLMEDIASERVER-BO	APP: ALLMediaServer 0.8 Buffer Overflow

Details of the signatures included within this bulletin:

HTTP:STC:IE:CVE-2017-11798-MC - HTTP: Microsoft Edge Scripting Engine CVE-2017-11798 Memory Corruption

Severity: HIGH

Description:

This signature detects an attempt to exploit an Use-After-Free Vulnerability in Microsoft Edge. Successful exploitation could allow an attacker to execute arbitrary code into the application's context.

Supported On:

isg-3.5.141652, idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, idp-5.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, isg-3.5.0, j-series-9.5, idp-4.2.110100823, idp-4.2.110101203, idp-5.1.0, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, vsrx-15.1, isg-3.5.141597, idp-5.1.110160603

References:

cve: CVE-2017-11798

HTTP:STC:DL:CVE-2017-11763-RCE - HTTP: Microsoft Graphics CVE-2017-11763 Remote Code Execution

Severity: HIGH

Description:

A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploited the vulnerability could take control of the affected system.

Supported On:

isg-3.5.141652, idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, idp-5.0.0, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, isg-3.5.0, j-series-9.5, idp-4.2.110100823, idp-4.2.110101203, idp-5.1.0, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, vsrx-15.1, isg-3.5.141597, idp-5.1.110160603

References:

bugtraq: 101109
cve: CVE-2017-11763

HTTP:STC:DL:CVE-2017-11762-RCE - HTTP: Microsoft Graphics CVE-2017-11762 Remote Code Execution

Severity: HIGH

Description:

A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. On successful exploitation remote attacker can execute commands with full user rights.

Supported On:

srx-branch-12.1, isg-3.5.141652, mx-11.4, idp-5.1.110161014, idp-4.1.0, mx-16.1, vsrx-12.1, srx-17.3, vmx-17.4, vsrx-15.1, idp-5.1.110160603, j-series-9.5, isg-3.5.141597, srx-12.1

References:

cve: CVE-2017-11762

CHAT:IRC:BOTNET:XDH-IRC-RCE - CHAT: Xdh / LinuxNet Perlbot / fBot IRC Bot Remote Code Execution

Severity: HIGH

Description:

his signature detects attempts to exploit a known vulnerability against Xdh IRC Bot. A successful attack can lead to arbitrary code execution.

Supported On:

References:

url: https://www.alienvault.com/open-threat-exchange/blog/elasticzombie-botnet-exploiting-elasticsearch-vulnerabilities

HTTP:MISC:FOREMAN-BOOKMARKS-RCE - HTTP: Foreman bookmarks_controller.rb Remote Code Execution

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Foreman. Successfully exploiting this issue will allow attackers to execute arbitrary code within the context of the user running the application.

Supported On:

References:

cve: CVE-2013-2121
bugtraq: 60833

Affected Products:

theforeman foreman 1.1

APP:MISC:SWAGGER-CODEGEN-PI - APP: JSON Swagger CodeGen Parameter Injector

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability in Swagger Code Generator. Successful exploitation could lead to arbitrary command injection.

Supported On:

References:

APP:SNORT:BACKORIFICE-DOS - APP: Snort BackOrifice Preprocessor Denial of Service

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Snort Back Orifice preprocessor. Snort version 2.4.2 and prior are vulnerable. A successful attack can create a denial-of-service condition, rendering the Snort sensor ineffective.

Supported On:

References:

cve: CVE-2005-3252
url: http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0505.html
bugtraq: 15131
url: http://www.us-cert.gov/cas/techalerts/TA05-291A.html

Affected Products:

Nortel Networks Threat Protection System Defense Center 4.1.0
Nortel Networks Threat Protection System Intrusion Sensor 4.1.0
Snort Project Snort 2.4.0 .0
Snort Project Snort 2.4.1
Snort Project Snort 2.4.2

APP:MISC:ALLMEDIASERVER-BO - APP: ALLMediaServer 0.8 Buffer Overflow

Severity: HIGH

Description:

This signature attempts to capture a stack buffer overflow in ALLMediaServer. The vulnerability is caused due to a boundary error within the handling request.

Supported On:

HTTP:APACHE:TOMCAT-PUT-RCE - HTTP: Apache Tomcat HTTP PUT Windows Remote Code Execution

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability in Apache Tomcat running on Windows. A remote attacker can exploit this vulnerability by uploading a specially crafted JSP page to the vulnerable server. This can result in remote code execution in the context of the affected service.

Supported On:

References:

cve: CVE-2017-12617
bugtraq: 100901
cve: CVE-2017-12615

SSL:TREND-MICRO-MSE-SQLI - SSL: Trend Micro Mobile Security Enterprise eas_agent_unregister slink_id SQL Injection

Severity: MEDIUM

Description:

This signature detects attempts to exploit a known vulnerability in Trend Micro Mobile Security Enterprise. Successful exploitation of this vulnerability can lead to remote code execution in the context of SYSTEM.

Supported On:

isg-3.5.141652, idp-5.1.110161014, idp-4.1.110110719, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, idp-5.0.0, isg-3.4.0, isg-3.5.0, isg-3.4.139899, j-series-9.5, srx-12.1, srx-branch-12.1, idp-4.2.110100823, idp-5.0.110130325, mx-11.4, isg-3.4.140032, idp-4.2.110101203, vsrx-12.1, idp-5.1.0, idp-5.0.110121210, vsrx-15.1, idp-4.1.110110609, isg-3.5.141597, idp-5.1.110160603

References:

bugtraq: 100966
cve: CVE-2017-14078

Affected Products:

trendmicro mobile_security 9.7

HTTP:STC:IE:CVE-2017-11800-RCE - HTTP: Microsoft Internet Explorer CVE-2017-11800 Remote Code Execution

Severity: HIGH

Description:

This signature detects attempts to exploit a known flaw in Microsoft IE and Edge. A successful attack would result in arbitrary code execution.

Supported On:

References:

cve: CVE-2017-11800

IMAP:OVERFLOW:MAILENABLE-LOGIN - IMAP: MailEnable IMAPD (2.34/2.35) Login Request Buffer Overflow

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against the MailEnable IMAP Server. Attackers can send a long string to the IMAP command to execute code with System-level permissions.

Supported On:

References:

cve: CVE-2006-623
bugtraq: 21492

Affected Products:

qnx rtos 6.3.0

HTTP:MISC:TREND-MICRO-MSE-SQLI - HTTP: Trend Micro Mobile Security Enterprise eas_agent_unregister slink_id SQL Injection

Severity: HIGH

Description:

Supported On:

References:

bugtraq: 100966
cve: CVE-2017-14078

Affected Products:

trendmicro mobile_security 9.7

HTTP:STC:IE:CVE-2017-11793-CE - HTTP: Microsoft Internet Explorer CVE-2017-11793 Remote Code Execution

Severity: HIGH

Description:

This signature detects an attempt to exploit a known vulnerability against Microsoft Internet Explorer. Successful exploitation of this issue may grant an attacker remote code execution.

Supported On:

References:

cve: CVE-2017-11793

HTTP:STC:IE:CVE-2017-11822-MC - HTTP: Microsoft Internet Explorer CVE-2017-11822 Memory Corruption

Severity: HIGH

Description:

This signature detects an attempt to exploit a known vulnerability against Microsoft Internet Explorer. Successful exploitation of this issue may grant an attacker remote code execution.

Supported On:

References:

cve: CVE-2017-11822

HTTP:STC:IE:CVE-2017-11810-MC - HTTP: Microsoft Internet Explorer CVE-2017-11810 Memory Corruption

Severity: HIGH

Description:

This signature detects an attempt to exploit a known vulnerability against Microsoft Internet Explorer. Successful exploitation of this issue may grant an attacker remote code execution.

Supported On:

References:

cve: CVE-2017-11810

HTTP:STC:IE:CVE-2017-8727-MC - HTTP: Microsoft Internet Explorer CVE-2017-8727 Memory Corruption

Severity: HIGH

Description:

This signature detects an attempt to exploit a known vulnerability against Microsoft Internet Explorer. Successful exploitation of this issue may grant an attacker remote code execution.

Supported On:

References:

cve: CVE-2017-8727

HTTP:STC:DL:CVE-2017-8689-EOP - HTTP: Microsoft Windows CVE-2017-8689 Elevation Of Privileges

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Microsoft Windows. A successful attack could allow the attacker to execute arbitrary commands with elevated privileges.

Supported On:

References:

cve: CVE-2017-8689

HTTP:STC:IE:CVE-2017-8694-EOP - HTTP: Windows Kernel-Mode Driver CVE-2017-8694 Elevation of Privileges

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Windows Kernel-Mode Driver. A successful attack can lead to elevation of privileges.

Supported On:

References:

cve: CVE-2017-8694