Update Details

Update #3425 (10/07/2021)

5 new signatures:

HIGH	HTTP:CTS:SCO-OPNSRVR-OS-INJ	HTTP: SCO Openserver OS Command Injection
CRITICAL	HTTP:DIR:CITRIX-SHRFLE-DIR-TRV	HTTP: Citrix ShareFile Storage Zones Controller NeatUpload Directory Traversal
CRITICAL	HTTP:CTS:ZEROSHELL-CGI-BIN-RCE	HTTP: ZeroShell CVE-2019-12725 Remote Code Execution
MEDIUM	HTTP:STC:ADOBE:DC-XOBJ-HGHT-MC	HTTP: Adobe Acrobat DC SMask Image XObject Height Out of Bounds Write
HIGH	HTTP:CTS:GENEXIS-PLAT-RCE	HTTP: Genexis Platinium CVE-2021-29003 Remote Code Execution

1 updated signature:

CRITICAL

HTTP:SQL:INJ:DELTA-IADH-SQLI

HTTP: Delta Industrial Automation DIAEnergie Multiple SQL Injection

Details of the signatures included within this bulletin:

HTTP:CTS:SCO-OPNSRVR-OS-INJ - HTTP: SCO Openserver OS Command Injection

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against SCO Openserver. A successful attack can lead to arbitrary code execution.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, srx-17.4, idp-5.1.110170603, vsrx-15.1

References:

cve: CVE-2020-25494

Affected Products:

Xinuos openserver 5.0.7
Xinuos openserver 6.0

HTTP:CTS:GENEXIS-PLAT-RCE - HTTP: Genexis Platinium CVE-2021-29003 Remote Code Execution

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Genexis Platinium. A successful attack can lead to arbitrary code execution.

Supported On:

References:

cve: CVE-2021-29003

HTTP:CTS:ZEROSHELL-CGI-BIN-RCE - HTTP: ZeroShell CVE-2019-12725 Remote Code Execution

Severity: CRITICAL

Description:

This signature detects attempts to exploit a known vulnerability against ZeroShell. A successful attack can lead to arbitrary code execution.

Supported On:

References:

cve: CVE-2019-12725

Affected Products:

Zeroshell zeroshell 3.9.0

HTTP:DIR:CITRIX-SHRFLE-DIR-TRV - HTTP: Citrix ShareFile Storage Zones Controller NeatUpload Directory Traversal

Severity: CRITICAL

Description:

This signature detects attempts to exploit a known vulnerability against NeatUpload library of Citrix ShareFile Storage Zones Controller. A successful attack can lead to directory traversal and arbitrary code execution.

Supported On:

References:

url: https://support.citrix.com/article/CTX328123
cve: CVE-2021-22941

Affected Products:

Citrix sharefile_storagezones_controller

HTTP:SQL:INJ:DELTA-IADH-SQLI - HTTP: Delta Industrial Automation DIAEnergie Multiple SQL Injection

Severity: CRITICAL

Description:

This signature detects attempts to exploit a known vulnerability against Delta. A successful attack can lead to command injection and arbitrary code execution.

Supported On:

References:

Affected Products:

Deltaww diaenergie 1.7.5

HTTP:STC:ADOBE:DC-XOBJ-HGHT-MC - HTTP: Adobe Acrobat DC SMask Image XObject Height Out of Bounds Write

Severity: MEDIUM

Description:

This signature detects attempts to exploit a known vulnerability against Adobe Acrobat Pro DC. A successful attack can lead to arbitrary code execution.

Supported On:

idp-5.1.110161014, idp-4.1.0, mx-16.1, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, srx-17.4, idp-5.1.110170603, vsrx3bsd-18.2, srx-18.2, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, srx-branch-19.1, vsrx-19.2, srx-19.2, srx-branch-19.2, vsrx3bsd-19.2, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, j-series-9.5, mx-11.4, srx-12.1, srx-branch-12.1, vsrx-12.1, vsrx-15.1

References:

cve: CVE-2021-39843