Update Details

Update #3327 (11/05/2020)

8 new signatures:

HIGH	HTTP:STC:ADOBE:CVE2020-24426-OB	HTTP: Adobe Acrobat Reader CVE-2020-24426 Out-Of-Bounds Read
HIGH	HTTP:STC:DL:CVE-2020-16998-PE	HTTP: Microsoft Windows DXG Kernel Driver CVE-2020-16698 Privilege Escalation
CRITICAL	HTTP:MISC:RUCKUS-IOT-AUTH-BYPAS	HTTP: Ruckus IoT Controller Web UI Authentication Bypass
HIGH	HTTP:STC:IE:CVE-2020-17052-MC	HTTP: Microsoft Internet Explorer Scripting Engine CVE-2020-17052 Memory Corruption
HIGH	HTTP:STC:ADOBE:CVE-2020-24438	HTTP: Adobe Acrobat Reader CVE-2020-24438 Use After Free
CRITICAL	HTTP:ORACLE:WLOGIC-UNAUTH-RCE	HTTP: Oracle Weblogic Server CVE-2020-14882 Remote Code Execution
MEDIUM	HTTP:TEAMVIEWER-RCE	HTTP: Teamviewer CVE-2020-13699 Remote Code Execution
HIGH	HTTP:STC:DL:CVE-2020-17038-EOP	HTTP: Microsoft Windows Win32K Kernel Driver CVE-2020-17038 Elevation of Privilege

7 new application2 signatures:

Infrastructure:YOKOGAWA-PROTOCOL	This layer classifies only a limited number of protocols known to be used by Yokogowa hardware.
Infrastructure:MT-SICS	Standard Interface Command Set (SICS) is a protocol to control Mettler Toledo industrial scales.
Infrastructure:KEYENCE-BARECODE	This plugin classifies the control protocol of Keyence Barecode scanners, that is also used by AutoID Network Navigator, their setup software.
Infrastructure:SCHNEIDER-ION	Integrated Object Network (ION) is a proprietary SCADA protocol for Schneider Electrics smart meters.
Infrastructure:EQUIP-COMMAND	This layer classifies EquipCommand protocol from TotalTrax equipment (SX/VX series), it solely handles the non-ciphered part of this protocol.
Infrastructure:SIEMENS-APOGEE	This plugin classifies the main data protocol used by Siemens Apogee HVAC product line. This device also uses BACnet and other control protocols that are not covered here.
Infrastructure:FANUC-GEN	This layer gathers signatures of protocols used by Fanuc equipments. This layer does not cover ALL protocols generated by Fanuc equipments.

3 updated signatures:

HIGH	HTTP:DIR:ADVTECH-WA-NMS-DIRTRV	HTTP: Advantech WebAccess NMS Multiple Arbitrary Directory Traversal
CRITICAL	HTTP:CTS:ADVTECH-NMS-ARB-UPLOAD	HTTP: Advantech WebAccess NMS SupportDeviceaddAction Arbitrary File Upload
MEDIUM	HTTP:STC:ENCODING-TYPE-EVASION	HTTP: HTTP Illegal Chars After Encoding Type Evasion Attempt

Details of the signatures included within this bulletin:

HTTP:STC:ADOBE:CVE2020-24426-OB - HTTP: Adobe Acrobat Reader CVE-2020-24426 Out-Of-Bounds Read

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Adobe Acrobat Reader. A successful attack can lead to arbitrary code execution.

Supported On:

idp-5.1.110161014, idp-4.1.0, mx-16.1, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, srx-17.4, idp-5.1.110170603, vsrx3bsd-18.2, srx-18.2, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, srx-branch-19.1, vsrx-19.2, srx-19.2, srx-branch-19.2, vsrx3bsd-19.2, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, j-series-9.5, mx-11.4, srx-12.1, srx-branch-12.1, vsrx-12.1, vsrx-15.1

References:

cve: CVE-2020-24426

HTTP:DIR:ADVTECH-WA-NMS-DIRTRV - HTTP: Advantech WebAccess NMS Multiple Arbitrary Directory Traversal

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Advantech WebAccess NMS. A successful attack can lead to directory traversal and arbitrary code execution.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, srx-17.4, idp-5.1.110170603, vsrx-15.1

References:

url: http://www.zerodayinitiative.com/advisories/ZDI-20-379/
cve: CVE-2020-10619
url: http://www.zerodayinitiative.com/advisories/ZDI-20-384/
cve: CVE-2020-10631

HTTP:STC:DL:CVE-2020-16998-PE - HTTP: Microsoft Windows DXG Kernel Driver CVE-2020-16698 Privilege Escalation

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Microsoft Windows DXG Kernel Driver. A successful attack can lead to elevation of privilege and arbitrary code execution.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, idp-5.0.0, vsrx-17.4, srx-branch-17.4, srx-17.4, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, isg-3.5.141818, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, isg-3.0.0, idp-5.1.110170603, vsrx-15.1

References:

cve: CVE-2020-16998

HTTP:STC:ENCODING-TYPE-EVASION - HTTP: HTTP Illegal Chars After Encoding Type Evasion Attempt

Severity: MEDIUM

Description:

This signature detects HTTP illegal characters after encoding type evasion attempt.

Supported On:

HTTP:MISC:RUCKUS-IOT-AUTH-BYPAS - HTTP: Ruckus IoT Controller Web UI Authentication Bypass

Severity: CRITICAL

Description:

This signature detects attempts to exploit a known vulnerability against Ruckus IoT Controller Web UI. A successful attack can lead to security bypass.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, srx-17.4, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, isg-3.0.0, idp-5.1.110170603, vsrx-15.1

References:

HTTP:STC:IE:CVE-2020-17052-MC - HTTP: Microsoft Internet Explorer Scripting Engine CVE-2020-17052 Memory Corruption

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Microsoft Internet Explorer. A successful attack can lead to arbitrary code execution.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, srx-17.4, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, idp-5.1.110170603, vsrx-15.1

References:

cve: CVE-2020-17052

HTTP:STC:ADOBE:CVE-2020-24438 - HTTP: Adobe Acrobat Reader CVE-2020-24438 Use After Free

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Adobe Acrobat Reader. A successful attack can lead to arbitrary code execution.

Supported On:

References:

HTTP:ORACLE:WLOGIC-UNAUTH-RCE - HTTP: Oracle Weblogic Server CVE-2020-14882 Remote Code Execution

Severity: CRITICAL

Description:

This signature detects attempts to exploit a known vulnerability against Oracle WebLogic Server. A successful attack can lead to arbitrary code execution.

Supported On:

References:

cve: CVE-2020-14750
cve: CVE-2020-14882

Infrastructure:FANUC-GEN - FANUC-GEN

Description:

This layer gathers signatures of protocols used by Fanuc equipments. This layer does not cover ALL protocols generated by Fanuc equipments.

Supported On:

mx-11.4, srx-12.1, srx-branch-12.1, vsrx-15.1

HTTP:CTS:ADVTECH-NMS-ARB-UPLOAD - HTTP: Advantech WebAccess NMS SupportDeviceaddAction Arbitrary File Upload

Severity: CRITICAL

Description:

This signature detects attempts to exploit a known vulnerability against Advantech WebAccess NMS. A successful attack can lead to arbitrary code execution.

Supported On:

References:

Infrastructure:YOKOGAWA-PROTOCOL - YOKOGAWA-PROTOCOL

Description:

This layer classifies only a limited number of protocols known to be used by Yokogowa hardware.

Supported On:

mx-11.4, srx-12.1, srx-branch-12.1, vsrx-15.1

HTTP:TEAMVIEWER-RCE - HTTP: Teamviewer CVE-2020-13699 Remote Code Execution

Severity: MEDIUM

Description:

This signature detects attempts to exploit a known vulnerability against Teamviewer. A successful attack can lead to arbitrary code execution.

Supported On:

References:

Infrastructure:MT-SICS - MT-SICS

Description:

Standard Interface Command Set (SICS) is a protocol to control Mettler Toledo industrial scales.

Supported On:

mx-11.4, srx-12.1, srx-branch-12.1, vsrx-15.1

Infrastructure:KEYENCE-BARECODE - KEYENCE-BARECODE

Description:

This plugin classifies the control protocol of Keyence Barecode scanners, that is also used by AutoID Network Navigator, their setup software.

Supported On:

mx-11.4, srx-12.1, srx-branch-12.1, vsrx-15.1

Infrastructure:SCHNEIDER-ION - SCHNEIDER-ION

Description:

Integrated Object Network (ION) is a proprietary SCADA protocol for Schneider Electrics smart meters.

Supported On:

mx-11.4, srx-12.1, srx-branch-12.1, vsrx-15.1

Infrastructure:EQUIP-COMMAND - EQUIP-COMMAND

Description:

This layer classifies EquipCommand protocol from TotalTrax equipment (SX/VX series), it solely handles the non-ciphered part of this protocol.

Supported On:

mx-11.4, srx-12.1, srx-branch-12.1, vsrx-15.1

Infrastructure:SIEMENS-APOGEE - SIEMENS-APOGEE

Description:

This plugin classifies the main data protocol used by Siemens Apogee HVAC product line. This device also uses BACnet and other control protocols that are not covered here.

Supported On:

mx-11.4, srx-12.1, srx-branch-12.1, vsrx-15.1

HTTP:STC:DL:CVE-2020-17038-EOP - HTTP: Microsoft Windows Win32K Kernel Driver CVE-2020-17038 Elevation of Privilege

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Microsoft Windows Win32K Kernel Driver. A successful attack can lead to elevation of privilege and arbitrary code execution.

Supported On:

References:

cve: CVE-2020-17038