Update Details

Update #3397 (07/01/2021)

6 new signatures:

MEDIUM	HTTP:APACHE:SS-URLRDRCT-RCE	HTTP: Apache Superset URL Shortener Open Redirect
CRITICAL	HTTP:CTS:SOLRWIND-NW-PM-DES	HTTP: SolarWinds Network Performance Monitor Insecure Deserialization
HIGH	HTTP:APACHE:SOLR-REPLCTN-SSRF	HTTP: Apache Solr ReplicationHandler Server-Side Request Forgery
HIGH	APP:MISC:APACHE-DUBBO-SCRPT-CE1	APP: Apache Dubbo Script Routing Type 1 Remote Code Execution
HIGH	APP:MISC:APACHE-DUBBO-SCRPT-CE2	APP: Apache Dubbo Script Routing Type 2 Remote Code Execution
MEDIUM	HTTP:OVERFLOW:OMRON-CXONE-BOF	HTTP: Omron CX-One CX-Position NCI File Stack Buffer Overflow

6 updated signatures:

MEDIUM	HTTP:CTS:CVE-2021-26855-AFW	HTTP: Microsoft Exchange Server CVE-2021-26855 Arbitrary File Write
HIGH	HTTP:SQL:INJ:ADVNTCH-IVIEW-SQLI	HTTP: Advantech iView Multiple SQL Injection
HIGH	FTP:COMMAND:MULTIPLE-OF	FTP: Multiple Vendor Command Overflow
MEDIUM	HTTP:ORACLE:E-BUSINESS-SUIT-DOS	HTTP: Oracle E-Business Suite Sales Offline Denial Of Service
HIGH	HTTP:XSS:ZOHO-PRGRM-ACTION-XSS	HTTP: Zoho ManageEngine Applications Manager Program Action Stored Cross-Site Scripting
LOW	HTTP:XSS:JENKINS-REP-CON-SXSS	HTTP: Jenkins Repository Connector Plugin Stored Cross-Site Scripting

Details of the signatures included within this bulletin:

HTTP:CTS:CVE-2021-26855-AFW - HTTP: Microsoft Exchange Server CVE-2021-26855 Arbitrary File Write

Severity: MEDIUM

Description:

This signature detects attempts to exploit a known vulnerability against Microsoft Exchange Server. A successful attack can lead to arbitrary code execution.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, srx-17.4, idp-5.1.110170603, vsrx-15.1

References:

cve: CVE-2021-26858

Affected Products:

Microsoft exchange_server 2019
Microsoft exchange_server 2016
Microsoft exchange_server 2013

HTTP:APACHE:SS-URLRDRCT-RCE - HTTP: Apache Superset URL Shortener Open Redirect

Severity: MEDIUM

Description:

This signature detects attempts to exploit a known vulnerability against Apache Superset. A successful attack can lead to arbitrary code execution.

Supported On:

References:

Affected Products:

Apache superset 1.0.1

HTTP:CTS:SOLRWIND-NW-PM-DES - HTTP: SolarWinds Network Performance Monitor Insecure Deserialization

Severity: CRITICAL

Description:

This signature detects attempts to exploit a known vulnerability against Solarwinds Network Performance Monitor. A successful exploitation can result in arbitrary code execution in the security context of the system.

Supported On:

References:

Affected Products:

Solarwinds network_performance_monitor 2020.2.1

HTTP:APACHE:SOLR-REPLCTN-SSRF - HTTP: Apache Solr ReplicationHandler Server-Side Request Forgery

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Apache Solr. A successful attack can lead to arbitrary code execution.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, idp-5.0.0, vsrx-17.4, srx-branch-17.4, srx-17.4, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, isg-3.5.141818, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, isg-3.0.0, idp-5.1.110170603, vsrx-15.1

References:

cve: CVE-2021-27905

Affected Products:

Apache solr

HTTP:SQL:INJ:ADVNTCH-IVIEW-SQLI - HTTP: Advantech iView Multiple SQL Injection

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Advantech iView. A successful attack can lead to command injection and arbitrary code execution.

Supported On:

References:

url: http://www.zerodayinitiative.com/advisories/ZDI-21-656/
url: http://www.zerodayinitiative.com/advisories/ZDI-21-650/
cve: CVE-2021-32932
url: http://www.zerodayinitiative.com/advisories/ZDI-21-654/
url: http://www.zerodayinitiative.com/advisories/ZDI-21-190/
cve: CVE-2021-22654
cve: CVE-2021-22658

Affected Products:

Advantech iview

APP:MISC:APACHE-DUBBO-SCRPT-CE1 - APP: Apache Dubbo Script Routing Type 1 Remote Code Execution

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Apache Dubbo. A successful attack can lead to arbitrary code execution.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, srx-17.4, idp-5.1.110170603, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, isg-3.0.0, isg-3.1.134269, vsrx-15.1

References:

Affected Products:

Apache dubbo 2.7.0
Apache dubbo 2.5.0

APP:MISC:APACHE-DUBBO-SCRPT-CE2 - APP: Apache Dubbo Script Routing Type 2 Remote Code Execution

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Apache Dubbo. A successful attack can lead to arbitrary code execution.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, srx-17.4, idp-5.1.110170603, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, isg-3.0.0, isg-3.1.134269, vsrx-15.1

References:

Affected Products:

Apache dubbo 2.7.0
Apache dubbo 2.5.0

HTTP:XSS:JENKINS-REP-CON-SXSS - HTTP: Jenkins Repository Connector Plugin Stored Cross-Site Scripting

Severity: LOW

Description:

This signature detects attempts to exploit a known cross-site scripting vulnerability against Jenkins Repository Connector Plugin. It is due to insufficient validation of user-supplied input. Attackers can steal cookie-based authentication credentials and launch other attacks.

Supported On:

References:

Affected Products:

Jenkins repository_connector 2.0.2

HTTP:XSS:ZOHO-PRGRM-ACTION-XSS - HTTP: Zoho ManageEngine Applications Manager Program Action Stored Cross-Site Scripting

Severity: HIGH

Description:

This signature detects attempts to exploit a known cross-site scripting vulnerability against Zoho ManageEngine. It is due to insufficient validation of user-supplied input. Attackers can steal cookie-based authentication credentials and launch other attacks.

Supported On:

References:

FTP:COMMAND:MULTIPLE-OF - FTP: Multiple Vendor Command Overflow

Severity: HIGH

Description:

This signature detects attempts to exploit known vulnerabilities in multiple FTP servers. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the vulnerable service.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, srx-17.4, idp-5.1.110170603, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, vsrx-15.1

References:

bugtraq: 14339
bugtraq: 8542
bugtraq: 8375
cve: CVE-2003-0727
cve: CVE-2006-5001
bugtraq: 49427
cve: CVE-2006-3952
cve: CVE-2003-0772
url: http://www.blackhat.com/presentations/bh-usa-03/bh-us-03-litchfield-paper.pdf
cve: CVE-1999-0256
cve: CVE-2009-3023

Affected Products:

Whitsoft slimftpd 3.16.0
Whitsoft slimftpd 3.15.0
Whitsoft slimftpd 3.14.0
Whitsoft slimftpd 3.13.0
Whitsoft slimftpd 3.12.0
Whitsoft slimftpd 3.11.0

HTTP:OVERFLOW:OMRON-CXONE-BOF - HTTP: Omron CX-One CX-Position NCI File Stack Buffer Overflow

Severity: MEDIUM

Description:

This signature detects attempts to exploit a known vulnerability against Omron CX-One. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the user.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, idp-5.0.0, vsrx-17.4, srx-branch-17.4, srx-17.4, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, srx-branch-19.1, vsrx-19.2, srx-19.2, srx-branch-19.2, vsrx3bsd-19.2, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, j-series-9.5, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, idp-4.2.110100823, isg-3.5.141818, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, isg-3.0.0, idp-5.1.110170603, vsrx-15.1

References:

Affected Products:

Omron cx-server 5.0.29
Omron cx-one 4.60

HTTP:ORACLE:E-BUSINESS-SUIT-DOS - HTTP: Oracle E-Business Suite Sales Offline Denial Of Service

Severity: MEDIUM

Description:

This signature detects attempts to exploit a known vulnerability against Oracle E-Business. A successful attack can result in a denial-of-service condition.