Update Details

Update #3307 (08/13/2020)

9 deprecated signatures:

CRITICAL	HTTP:HPE-CVE-2019-11941-EL	HTTP: HPE Intelligent Management Center CVE-2019-11941 Expression Language Injection	Removal Date: 09/07/2020	Reason For Deprecation: Pattern covered in https://qnc-sigdb1.juniper.net/sigs/signature/20161/
HIGH	HTTP:CTS:HPE-IMC-EXP-LANG-INJ	HTTP: HPE IMC CustomReportTemplateSelectBean Expression Language Injection	Removal Date: 09/07/2020	Reason For Deprecation: Covered in https://qnc-sigdb1.juniper.net/sigs/signature/20161/
HIGH	HTTP:CTS:HPE-IMC-EXPINJ	HTTP: HPE IMC devGroupSelect Expression Language Injection	Removal Date: 09/07/2020	Reason For Deprecation: Covered in https://qnc-sigdb1.juniper.net/sigs/signature/20161/
HIGH	HTTP:CTS-HPE-IMC-RCE	HTTP: HPE Intelligent Management Center iccSelectCommand Expression Language Injection	Removal Date: 09/08/2020	Reason For Deprecation: Covered in https://qnc-sigdb1.juniper.net/sigs/signature/20161/
CRITICAL	HTTP:MISC:HPE-IMC-ELINJ	HTTP: HPE Intelligent Management Center SoapConfigBean Expression Language Injection	Removal Date: 09/08/2020	Reason For Deprecation: Covered in https://qnc-sigdb1.juniper.net/sigs/signature/20161/
HIGH	HTTP:HPE-IMCP-URL-RCE	HTTP: HPE Intelligent Management Center PlatNavigationToBean URL Expression Language Injection	Removal Date: 09/08/2020	Reason For Deprecation: Covered in https://qnc-sigdb1.juniper.net/sigs/signature/20161/
HIGH	HTTP:HPE-INJECTION-RCE	HTTP: HPE Intelligent Management Center wmiConfigContent Expression Language Injection	Removal Date: 09/08/2020	Reason For Deprecation: Covered in https://qnc-sigdb1.juniper.net/sigs/signature/20161/
HIGH	HTTP:CTS:HPE-IMC-FR-EL-CI	HTTP: HPE IMC ForwardRedirect Expression Language Injection	Removal Date: 09/08/2020	Reason For Deprecation: Covered in https://qnc-sigdb1.juniper.net/sigs/signature/20161/
CRITICAL	HTTP:MISC:HPE-IMC-OPETATOR-CE	HTTP: HPE IMC OperatorGroupTreeSelectBean Expression Language Injection	Removal Date: 09/08/2020	Reason For Deprecation: Covered in https://qnc-sigdb1.juniper.net/sigs/signature/20161/

Customers are suggested to remove the deprecated signatures from the IDP policy, if they are explicitly configured, other than Dynamic groups

3 new signatures:

CRITICAL	HTTP:SQL:INJ:ZOHO-ALRTMGRP-SID	HTTP: Zoho ManageEngine Applications Manager AlertRes_Mtrgrp.jsp sid SQL Injection
HIGH	HTTP:STC:ADOBE:CVE-2020-9695-BO	HTTP: Adobe Acorabat Reader CVE-2020-9695 Buffer Overflow
MEDIUM	HTTP:STC:ADOBE:CVE-2020-9705-ID	HTTP: Adobe Acrobat Reader CVE-2020-9705 Information disclosure

3 updated signatures:

CRITICAL	HTTP:MS-WIN-LNK-RCE	HTTP: Microsoft Windows LNK Remote Code Execution
HIGH	SMB:MS-CVE-2020-0796-RCE	SMB: Microsoft Windows CVE-2020-0796 SMBv3 Client/Server Remote Code Execution
MEDIUM	HTTP:STC:IE:MAL-VB-JSCRIPT	HTTP: Microsoft Internet Explorer Malformed VBScript/JScript

1 deleted signature:

HTTP:STC:DL:QT-UDTA-ATOM1

HTTP: Apple QuickTime 'udta' Atom Parsing Heap Overflow Vulnerability1

Details of the signatures included within this bulletin:

HTTP:MS-WIN-LNK-RCE - HTTP: Microsoft Windows LNK Remote Code Execution

Severity: CRITICAL

Description:

This signature detects attempts to exploit a known vulnerability against Microsoft Windows lnk structure. A successful attack can lead to arbitrary code execution on the target system.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, srx-17.4, idp-5.1.110170603, vsrx-15.1

References:

cve: CVE-2020-0729
cve: CVE-2020-1421

Affected Products:

Microsoft windows_server_2012 r2
Microsoft windows_server_2008 -
Microsoft windows_server_2016 -
Microsoft windows_10 -
Microsoft windows_7 -
Microsoft windows_10 1709
Microsoft windows_server_2012 -
Microsoft windows_server_2008 r2
Microsoft windows_8.1 -
Microsoft windows_10 1903
Microsoft windows_server_2016 1909
Microsoft windows_server_2016 1803
Microsoft windows_server_2019 -
Microsoft windows_10 1809
Microsoft windows_10 1909
Microsoft windows_10 1803
Microsoft windows_rt_8.1 -
Microsoft windows_server_2016 1903
Microsoft windows_10 1607

HTTP:STC:ADOBE:CVE-2020-9705-ID - HTTP: Adobe Acrobat Reader CVE-2020-9705 Information disclosure

Severity: MEDIUM

Description:

This signature detects attempts to exploit a known vulnerability against Adobe Acrobat Reader. A successful attack can lead to sensitive information disclosure.

Supported On:

idp-5.1.110161014, idp-4.1.0, mx-16.1, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, srx-17.4, idp-5.1.110170603, vsrx3bsd-18.2, srx-18.2, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, srx-branch-19.1, vsrx-19.2, srx-19.2, srx-branch-19.2, vsrx3bsd-19.2, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, j-series-9.5, mx-11.4, srx-12.1, srx-branch-12.1, vsrx-12.1, vsrx-15.1

References:

Affected Products:

Adobe acrobat_reader_dc 17.012.20093
Adobe acrobat_reader_dc 15.016.20041
Adobe acrobat_reader_dc 15.006.30504
Adobe acrobat_reader_dc 15.006.30434
Adobe acrobat_dc 15.016.20041
Adobe acrobat_reader_dc 15.006.30416
Adobe acrobat_reader_dc 17.000.0000
Adobe acrobat_reader_dc 17.011.30078
Adobe acrobat_reader_dc 17.011.30102
Adobe acrobat_reader_dc 19.008.20074
Adobe acrobat_reader_dc 15.006.30173
Adobe acrobat_dc 17.011.30106
Adobe acrobat_dc 15.010.20059
Adobe acrobat_dc 17.011.30166
Adobe acrobat_reader_dc 20.006.20042
Adobe acrobat_reader_dc 15.017.20050
Adobe acrobat_dc 15.006.30413
Adobe acrobat_reader_dc 15.006.30418
Adobe acrobat_reader_dc 17.011.30059
Adobe acrobat_dc 15.006.30198
Adobe acrobat_dc 15.006.30498
Adobe acrobat_dc 19.008.20074
Adobe acrobat_reader_dc 17.011.30106
Adobe acrobat_dc 17.011.30110
Adobe acrobat_dc 17.011.30102
Adobe acrobat_reader_dc 18.011.20038
Adobe acrobat_dc 19.008.20081
Adobe acrobat_dc 15.006.30417
Adobe acrobat_reader_dc 15.010.20059
Adobe acrobat_dc 18.011.20058
Adobe acrobat_reader_dc 15.006.30094
Adobe acrobat_reader_dc 18.009.20050
Adobe acrobat_reader_dc 15.006.30448
Adobe acrobat_dc 15.017.20050
Adobe acrobat_dc 17.009.20058
Adobe acrobat_reader_dc 17.011.30166
Adobe acrobat_reader_dc 15.006.30198
Adobe acrobat_dc 15.006.30464
Adobe acrobat_reader_dc 15.006.30475
Adobe acrobat_reader_dc 15.020.20042
Adobe acrobat_reader_dc 17.011.30142
Adobe acrobat_dc 19.012.20034
Adobe acrobat_reader_dc 17.012.20098
Adobe acrobat_reader_dc 17.011.30080
Adobe acrobat_reader_dc 15.023.20056
Adobe acrobat_dc 19.010.20091
Adobe acrobat_reader_dc 17.011.30140
Adobe acrobat_dc 19.012.20036
Adobe acrobat_dc 15.023.20056
Adobe acrobat_dc 15.006.30097
Adobe acrobat_reader_dc 17.011.30127
Adobe acrobat_reader_dc 15.016.20039
Adobe acrobat_dc 17.011.30080
Adobe acrobat_reader_dc 15.006.30097
Adobe acrobat_reader_dc 15.006.30121
Adobe acrobat_reader_dc 18.011.20040
Adobe acrobat_dc 17.011.30127
Adobe acrobat_dc 17.011.30142
Adobe acrobat_dc 17.011.30068
Adobe acrobat_dc 15.008.20082
Adobe acrobat_reader_dc 19.010.20091
Adobe acrobat_reader_dc 17.011.30068
Adobe acrobat_dc 15.006.30482
Adobe acrobat_dc 15.006.30280
Adobe acrobat_reader_dc 15.006.30355
Adobe acrobat_dc 15.006.30173
Adobe acrobat_reader_dc 15.008.20082
Adobe acrobat_reader_dc 15.006.30464
Adobe acrobat_dc 17.012.20095
Adobe acrobat_reader_dc 17.011.30110
Adobe acrobat_dc 17.011.30099
Adobe acrobat_reader_dc 17.009.20044
Adobe acrobat_reader_dc 17.011.30099
Adobe acrobat_reader_dc 15.006.30482
Adobe acrobat_reader_dc 15.006.30518
Adobe acrobat_dc 17.011.30079
Adobe acrobat_dc 19.008.20071
Adobe acrobat_dc 15.006.30355
Adobe acrobat_dc 15.006.30457
Adobe acrobat_dc 15.010.20060
Adobe acrobat_reader_dc 15.006.30457
Adobe acrobat_reader_dc 19.008.20080
Adobe acrobat_reader_dc 15.006.30497
Adobe acrobat_dc 15.006.30518
Adobe acrobat_dc 19.008.20080
Adobe acrobat_reader_dc 18.011.20063
Adobe acrobat_dc 15.006.30418
Adobe acrobat_dc 15.006.30448
Adobe acrobat_dc 17.011.30066
Adobe acrobat_reader_dc 19.010.20069
Adobe acrobat_reader_dc 15.006.30495
Adobe acrobat_dc 15.017.20053
Adobe acrobat_dc 17.009.20044
Adobe acrobat_reader_dc 17.011.30079
Adobe acrobat_dc 19.010.20069
Adobe acrobat_dc 15.006.30493
Adobe acrobat_dc 15.006.30279
Adobe acrobat_dc 17.012.20096
Adobe acrobat_reader_dc 15.006.30493
Adobe acrobat_reader_dc 15.023.20070
Adobe acrobat_reader_dc 15.006.30172
Adobe acrobat_reader_dc 19.008.20081
Adobe acrobat_reader_dc 15.006.30505
Adobe acrobat_reader_dc 19.008.20071
Adobe acrobat_dc 15.006.30495
Adobe acrobat_dc 15.023.20070
Adobe acrobat_dc 15.006.30174
Adobe acrobat_dc 17.012.20098
Adobe acrobat_dc 18.011.20063
Adobe acrobat_reader_dc 15.006.30174
Adobe acrobat_dc 15.006.30475
Adobe acrobat_reader_dc 17.012.20095
Adobe acrobat_dc 15.006.30497
Adobe acrobat_dc 15.006.30172
Adobe acrobat_dc 17.011.30152
Adobe acrobat_reader_dc 15.006.30279
Adobe acrobat_reader_dc 17.011.30156
Adobe acrobat_reader_dc 15.017.20053
Adobe acrobat_reader_dc 17.011.30105
Adobe acrobat_dc 17.011.30150
Adobe acrobat_reader_dc 17.011.30150
Adobe acrobat_dc 17.011.30156
Adobe acrobat_dc 15.006.30416
Adobe acrobat_reader_dc 17.011.30113
Adobe acrobat_dc 18.011.20040
Adobe acrobat_reader_dc 17.011.30152
Adobe acrobat_reader_dc 15.010.20056
Adobe acrobat_dc 19.010.20098
Adobe acrobat_reader_dc 20.001.30002
Adobe acrobat_reader_dc 15.006.30461
Adobe acrobat_reader_dc 15.006.30244
Adobe acrobat_dc 18.011.20055
Adobe acrobat_reader_dc 15.006.30201
Adobe acrobat_reader_dc 17.011.30065
Adobe acrobat_reader_dc 15.006.30417
Adobe acrobat_dc 17.000.0000
Adobe acrobat_dc 17.011.30113
Adobe acrobat_dc 15.010.20056
Adobe acrobat_dc 15.006.30244
Adobe acrobat_dc 15.006.30504
Adobe acrobat_dc 17.011.30143
Adobe acrobat_reader_dc 19.012.20035
Adobe acrobat_dc 15.009.20079
Adobe acrobat_dc 20.001.30002
Adobe acrobat_reader_dc 17.011.30143
Adobe acrobat_dc 15.023.20053
Adobe acrobat_dc 15.006.30094
Adobe acrobat_reader_dc 19.010.20098
Adobe acrobat_reader_dc 18.011.20055
Adobe acrobat_dc 20.006.20042
Adobe acrobat_dc 17.011.30065
Adobe acrobat_dc 19.012.20035
Adobe acrobat_dc 15.009.20069
Adobe acrobat_dc 15.006.30096
Adobe acrobat_dc 19.021.20058
Adobe acrobat_reader_dc 17.011.30096
Adobe acrobat_dc 17.011.30120
Adobe acrobat_reader_dc 15.009.20079
Adobe acrobat_dc 17.011.30096
Adobe acrobat_reader_dc 19.021.20047
Adobe acrobat_dc 15.020.20039
Adobe acrobat_dc 15.006.30060
Adobe acrobat_dc 17.011.30070
Adobe acrobat_reader_dc 15.023.20053
Adobe acrobat_dc 17.011.30059
Adobe acrobat_reader_dc 15.009.20069
Adobe acrobat_reader_dc 15.010.20060
Adobe acrobat_dc 18.009.20044
Adobe acrobat_dc 15.006.30508
Adobe acrobat_dc 19.010.20099
Adobe acrobat_dc 15.006.30201
Adobe acrobat_reader_dc 15.006.30498
Adobe acrobat_dc 18.011.20038
Adobe acrobat_dc 15.006.30243
Adobe acrobat_dc 17.011.30140
Adobe acrobat_dc 19.010.20100
Adobe acrobat_reader_dc 15.006.30508
Adobe acrobat_reader_dc 17.011.30066
Adobe acrobat_reader_dc 19.012.20036
Adobe acrobat_dc 18.009.20050
Adobe acrobat_dc 17.011.30105
Adobe acrobat_reader_dc 15.006.30243
Adobe acrobat_reader_dc 17.011.30144
Adobe acrobat_dc 15.016.20039
Adobe acrobat_reader_dc 17.009.20058
Adobe acrobat_reader_dc 19.010.20099
Adobe acrobat_reader_dc 19.010.20100
Adobe acrobat_reader_dc 19.012.20034
Adobe acrobat_dc 15.006.30121
Adobe acrobat_reader_dc 15.006.30096
Adobe acrobat_dc 19.021.20047
Adobe acrobat_reader_dc 15.009.20077
Adobe acrobat_reader_dc 17.011.30120
Adobe acrobat_reader_dc 15.006.30280
Adobe acrobat_dc 15.009.20071
Adobe acrobat_reader_dc 18.009.20044
Adobe acrobat_reader_dc 15.020.20039
Adobe acrobat_dc 19.010.20064
Adobe acrobat_reader_dc 15.006.30354
Adobe acrobat_dc 15.006.30352
Adobe acrobat_reader_dc 19.021.20058
Adobe acrobat_reader_dc 15.006.30060
Adobe acrobat_dc 15.006.30119
Adobe acrobat_dc 15.006.30306
Adobe acrobat_reader_dc 19.021.20056
Adobe acrobat_reader_dc 15.016.20045
Adobe acrobat_reader_dc 17.011.30070
Adobe acrobat_reader_dc 15.009.20071
Adobe acrobat_dc 17.011.30155
Adobe acrobat_reader_dc 15.006.30392
Adobe acrobat_reader_dc 15.006.30452
Adobe acrobat_dc 17.011.30078
Adobe acrobat_dc 15.009.20077
Adobe acrobat_reader_dc 19.010.20064
Adobe acrobat_dc 15.006.30394
Adobe acrobat_dc 15.006.30456
Adobe acrobat_reader_dc 15.006.30352
Adobe acrobat_reader_dc 15.006.30306
Adobe acrobat_reader_dc 15.006.30394
Adobe acrobat_reader_dc 17.011.30138
Adobe acrobat_dc 15.016.20045
Adobe acrobat_dc 15.006.30354
Adobe acrobat_dc 15.006.30392
Adobe acrobat_dc 15.006.30434
Adobe acrobat_dc 19.021.20056
Adobe acrobat_reader_dc 15.006.30456
Adobe acrobat_dc 17.012.20093
Adobe acrobat_dc 15.020.20042
Adobe acrobat_reader_dc 15.006.30119
Adobe acrobat_dc 15.006.30452
Adobe acrobat_dc 17.011.30138

HTTP:STC:DL:QT-UDTA-ATOM1 - HTTP: Apple QuickTime 'udta' Atom Parsing Heap Overflow Vulnerability1

Severity: MEDIUM

Description:

This signature detects attempts to exploit a known vulnerability against Apple Quicktime. A successful attack can lead to arbitrary code execution.

Supported On:

References:

bugtraq: 49558
cve: CVE-2011-2595

Affected Products:

Acdsee fotoslate 4.0

HTTP:SQL:INJ:ZOHO-ALRTMGRP-SID - HTTP: Zoho ManageEngine Applications Manager AlertRes_Mtrgrp.jsp sid SQL Injection

Severity: CRITICAL

Description:

This signature detects attempts to exploit a known vulnerability against Zoho ManageEngine Applications Manager. A successful attack can lead to command injection and arbitrary code execution.

Supported On:

References:

cve: CVE-2020-15533

HTTP:STC:ADOBE:CVE-2020-9695-BO - HTTP: Adobe Acorabat Reader CVE-2020-9695 Buffer Overflow

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Adobe Acorabat and Reader. A successful attack can lead to a buffer overflow and arbitrary remote code execution.

Supported On:

References:

SMB:MS-CVE-2020-0796-RCE - SMB: Microsoft Windows CVE-2020-0796 SMBv3 Client/Server Remote Code Execution

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Microsoft Windows SMBv3 Client/Server. A successful attack can lead to arbitrary code execution.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, idp-5.0.0, vsrx-17.4, srx-branch-17.4, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, isg-3.5.141818, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, srx-17.4, idp-5.1.110170603, vsrx-15.1

References:

cve: CVE-2020-0796

Affected Products:

Microsoft windows_10 1903
Microsoft windows_10 1909
Microsoft windows_server_2016 1909
Microsoft windows_server_2016 1903

HTTP:STC:IE:MAL-VB-JSCRIPT - HTTP: Microsoft Internet Explorer Malformed VBScript/JScript

Severity: MEDIUM

Description:

This signature detects attempts to exploit a known vulnerability in Microsoft Internet Explorer's Jscript and VBscript Engines. A successful attack can result in information disclosure.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, srx-17.4, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, idp-5.1.110170603, vsrx-15.1

References:

bugtraq: 46139
cve: CVE-2011-0031

Affected Products:

Microsoft vbscript 5.8
Microsoft jscript 5.8
Avaya aura_conferencing 6.0 Standard
Avaya aura_conferencing 6.0 SP1 Standard