Juniper Networks
Solutions
Products & Services
Company
Partners
Support
Education

Update Details

Security Intelligence Center
Print

Update #3431 (10/28/2021)

8 new signatures:

MEDIUMHTTP2:APACHE-TOMCAT-H2C-DOS-2HTTP2: Apache Tomcat HTTP2 h2c Memory Exhaustion 2
MEDIUMHTTP:STC:ADVANTECH-HMI-BOFHTTP: Advantech WebAccess HMI Designer PM3 NAnimatedGraphic Heap Buffer Overflow
HIGHRPC:DCERPC:ADVNTCH-WEB-IOCTL-BORPC: Advantech WebAccess IOCTL 10001 Buffer Overflow
HIGHTCP:C2S:RPC-ORACLE-SOLARIS-HBOTCP: Oracle Solaris RPC CVE-2017-3623 Heap Buffer Overflow
CRITICALHTTP:STC:DL:MS-CVE-2016-0092-CEHTTP: Microsoft Windows OLE CVE-2016-0092 Code Execution
MEDIUMHTTP:SQL:INJ:SINEC-NMS-DLT-FLDRHTTP: Siemens SINEC NMS CVE-2021-33730 SQL Injection
CRITICALHTTP:SQL:INJ:SOLARWINDS-BESHTTP: SolarWinds SRM Profiler BackupExceptionsServlet SQL Injection
MEDIUMHTTP:APACHE:OPNOFFICE-DBF-OVRFWHTTP: Apache OpenOffice dBase File Handling Buffer Overflow

2 updated signatures:

HIGHPORTMAPPER:ORACLE-SOLARIS-HBOPORTMAPPER: Oracle Solaris RPC CVE-2017-3623 Heap Buffer Overflow
MEDIUMHTTP:APACHE:APACHE-PATH-TRAVHTTP: Apache HTTP Server Directory Traversal


Details of the signatures included within this bulletin:

HTTP:APACHE:APACHE-PATH-TRAV - HTTP: Apache HTTP Server Directory Traversal

Severity: MEDIUM

Description:

This signature detects attempts to exploit a known vulnerability against Apache HTTP Server. A successful attack can lead to directory traversal and arbitrary code execution.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, srx-17.4, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, isg-3.0.0, idp-5.1.110170603, vsrx-15.1

References:

  • cve: CVE-2021-42013
  • url: https://httpd.apache.org/security/vulnerabilities_24.html
  • cve: CVE-2021-41773

Affected Products:

  • Apache http_server 2.4.49

HTTP2:APACHE-TOMCAT-H2C-DOS-2 - HTTP2: Apache Tomcat HTTP2 h2c Memory Exhaustion 2

Severity: MEDIUM

Description:

This signature detects attempts to exploit a known vulnerability against Apache Tomcat HTTP2 Server. A successful attack can result in a denial-of-service condition.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, srx-17.4, idp-5.1.110170603, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, isg-3.0.0, isg-3.1.134269, vsrx-15.1

References:

  • cve: CVE-2020-13934

Affected Products:

  • Apache tomcat 8.5.1-8.5.56
  • Apache tomcat 9.0.1-9.0.36
  • Apache tomcat 9.0.0
  • Apache tomcat 10.0.0

HTTP:STC:ADVANTECH-HMI-BOF - HTTP: Advantech WebAccess HMI Designer PM3 NAnimatedGraphic Heap Buffer Overflow

Severity: MEDIUM

Description:

This signature detects attempts to exploit a known vulnerability against Advantech WebAccess HMI Designer. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the Advantech WebAccess HMI Designer.

Supported On:

idp-5.1.110161014, mx-11.4, idp-4.1.0, mx-16.1, srx-branch-19.2, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, srx-17.4, idp-5.1.110170603, vsrx3bsd-18.2, srx-18.2, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-12.1, srx-branch-12.1, vsrx3bsd-19.2, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, vsrx-12.1, srx-branch-19.1, vsrx-15.1, srx-19.2

References:

  • url: http://www.zerodayinitiative.com/advisories/ZDI-21-487/
  • url: http://www.zerodayinitiative.com/advisories/ZDI-21-490/
  • cve: CVE-2021-33000

Affected Products:

  • Advantech webaccess/hmi_designer 2.1.9.95

RPC:DCERPC:ADVNTCH-WEB-IOCTL-BO - RPC: Advantech WebAccess IOCTL 10001 Buffer Overflow

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Advantech WebAccess IOCTL 10001. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the current user.

Supported On:

idp-5.1.110161014, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, mx-16.1, srx-branch-19.2, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, srx-17.4, idp-5.1.110170603, vsrx3bsd-18.2, srx-18.2, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-12.1, srx-branch-12.1, idp-4.2.110100823, srx-19.4, idp-5.0.110130325, srx-branch-19.4, vsrx3bsd-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, vsrx-12.1, idp-5.1.0, idp-5.0.110121210, srx-branch-19.1, vsrx-15.1, idp-4.1.110110609, srx-19.2, vsrx-19.4

References:

  • url: https://www.zerodayinitiative.com/advisories/ZDI-21-1054/
  • cve: CVE-2021-38408
  • url: http://www.zerodayinitiative.com/advisories/ZDI-21-1054/
  • url: https://www.zerodayinitiative.com/advisories/ZDI-21-779/
  • url: http://www.zerodayinitiative.com/advisories/ZDI-21-779/

Affected Products:

  • Advantech webaccess 9.02

TCP:C2S:RPC-ORACLE-SOLARIS-HBO - TCP: Oracle Solaris RPC CVE-2017-3623 Heap Buffer Overflow

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability in the Oracle Solaris RPC. Successful exploitation could lead to the arbitrary code execution.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, srx-17.4, idp-5.1.110170603, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, isg-3.0.0, isg-3.1.134269, vsrx-15.1

References:

  • cve: CVE-2017-3623

Affected Products:

  • Oracle solaris

HTTP:APACHE:OPNOFFICE-DBF-OVRFW - HTTP: Apache OpenOffice dBase File Handling Buffer Overflow

Severity: MEDIUM

Description:

This signature detects attempts to exploit a known vulnerability in the Apache OpenOffice. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the server.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, srx-17.4, idp-5.1.110170603, vsrx-15.1

References:

  • cve: CVE-2021-33035

Affected Products:

  • Apache openoffice 4.1.10

PORTMAPPER:ORACLE-SOLARIS-HBO - PORTMAPPER: Oracle Solaris RPC CVE-2017-3623 Heap Buffer Overflow

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability in the Oracle Solaris RPC. Successful exploitation could lead to the arbitrary code execution.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, idp-5.0.0, vsrx-17.4, srx-branch-17.4, srx-17.4, idp-5.1.110170603, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, isg-3.5.141818, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, isg-3.0.0, isg-3.1.134269, vsrx-15.1

References:

  • url: http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html
  • bugtraq: 97778
  • cve: CVE-2017-3623

Affected Products:

  • Oracle solaris

HTTP:SQL:INJ:SINEC-NMS-DLT-FLDR - HTTP: Siemens SINEC NMS CVE-2021-33730 SQL Injection

Severity: MEDIUM

Description:

This signature detects attempts to exploit a known vulnerability against Siemens SINEC NMS. A successful attack can lead to command injection and arbitrary code execution.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, srx-17.4, idp-5.1.110170603, vsrx-15.1

References:

  • cve: CVE-2021-33730

Affected Products:

  • Siemens sinec_nms 1.0
  • Siemens sinec_nms

HTTP:SQL:INJ:SOLARWINDS-BES - HTTP: SolarWinds SRM Profiler BackupExceptionsServlet SQL Injection

Severity: CRITICAL

Description:

This signature detects attempts to exploit a known vulnerability against SolarWinds. A successful attack can lead to command injection and arbitrary code execution.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, srx-17.4, idp-5.1.110170603, vsrx-15.1

References:

  • url: http://www.solarwinds.com/documentation/srm/docs/releasenotes/releasenotes.htm
  • cve: CVE-2016-4350
  • url: http://www.zerodayinitiative.com/advisories/zdi-16-253/

Affected Products:

  • Solarwinds storage_resource_monitor 6.2.1

HTTP:STC:DL:MS-CVE-2016-0092-CE - HTTP: Microsoft Windows OLE CVE-2016-0092 Code Execution

Severity: CRITICAL

Description:

This signature detects attempts to exploit a known vulnerability against Microsoft Windows. A successful attack can lead to arbitrary code execution.

Supported On:

idp-5.1.110161014, idp-4.1.0, mx-16.1, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, srx-17.4, idp-5.1.110170603, vsrx3bsd-18.2, srx-18.2, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, srx-branch-19.1, vsrx-19.2, srx-19.2, srx-branch-19.2, vsrx3bsd-19.2, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, j-series-9.5, mx-11.4, srx-12.1, srx-branch-12.1, vsrx-12.1, vsrx-15.1

References:

  • cve: CVE-2016-0092

Affected Products:

  • Microsoft windows_rt_8.1
  • Microsoft windows_10
  • Microsoft windows_server_2012
  • Microsoft windows_vista
  • Microsoft windows_8.1
  • Microsoft windows_7
  • Microsoft windows_server_2008
  • Microsoft windows_server_2008 r2
  • Microsoft windows_10 1511
  • Microsoft windows_server_2012 r2
Site Map
RSS Feeds
Careers
Accessibility
Feedback
Privacy Policy
Legal Notices
Copyright © 1999-2010 Juniper Networks, Inc. All rights reserved.
Help
|
My Account
|
Log Out