*** NK8 RELS 3317 Release *** Total number of signatures: 3179 Description ================================================================== In this signature, we addressed the exploits/vulnerabilities and applications as below: Added 3 rule(s): --------------- 1133495 WEB Generic Shellcode Obfuscation -1 1133496 TELNET DBLTek GoIP Backdoor Access 1133500 WEB Apache Struts Dynamic Method Invocation Remote Code Execution -1.u Modified 294 rule(s): --------------- 1048891 NETWORK icmpenum v1.1.1 via ICMP -1 1048892 NETWORK redirect host connect via ICMP -1 1048893 NETWORK redirect net via ICMP -1 1048897 NETWORK Source Quench connect via ICMP -1 1048904 NETWORK Destination Unreachable connect via ICMP -1 1048905 NETWORK Destination Unreachable connect via ICMP -2 1048906 NETWORK Destination Unreachable connect via ICMP -3 1048925 NETWORK PING connect via ICMP -1 1048926 NETWORK traceroute connect via ICMP -1 1048927 NETWORK Address Mask Reply connect via ICMP -1 1048929 NETWORK Address Mask Request connect via ICMP -1 1048931 NETWORK Alternate Host Address connect via ICMP -1 1048933 NETWORK Datagram Conversion Error connect via ICMP -1 1048935 NETWORK Destination Unreachable connect via ICMP -4 1048936 NETWORK Destination Unreachable connect via ICMP -5 1048937 NETWORK Destination Unreachable connect via ICMP -6 1048938 NETWORK Destination Unreachable connect via ICMP -7 1048939 NETWORK Destination Unreachable connect via ICMP -8 1048940 NETWORK Destination Unreachable connect via ICMP -9 1048941 NETWORK Destination Unreachable connect via ICMP -10 1048942 NETWORK Destination Unreachable connect via ICMP -11 1048943 NETWORK Destination Unreachable connect via ICMP -12 1048944 NETWORK Destination Unreachable connect via ICMP -13 1048945 NETWORK Destination Unreachable connect via ICMP -14 1048946 NETWORK Destination Unreachable connect via ICMP -15 1048947 NETWORK Destination Unreachable connect via ICMP -16 1048951 NETWORK Fragment Reassembly Time Exceeded connect via ICMP -1 1048956 NETWORK Information Reply connect via ICMP -1 1048958 NETWORK Information Request connect via ICMP -1 1048960 NETWORK Mobile Host Redirect connect via ICMP -1 1048962 NETWORK Mobile Registration Reply connect via ICMP -1 1048964 NETWORK Mobile Registration Request connect via ICMP -1 1048966 NETWORK Parameter Problem (Bad Length) connect via ICMP -1 1048967 NETWORK Parameter Problem (Missing a Requiered Option) connect via ICMP -1 1048968 NETWORK Parameter Problem (Unspecified Error) connect via ICMP -1 1048970 NETWORK Photuris (Reserved) connect via ICMP -1 1048971 NETWORK Photuris (Unknown Security Parameters Index) connect via ICMP -1 1048972 NETWORK Photuris (Authentication Failed) connect via ICMP -1 1048973 NETWORK Photuris (Decryption Failed) connect via ICMP -1 1048975 NETWORK Redirect (for TOS and Host) connect via ICMP -1 1048976 NETWORK Redirect (for TOS and Network) connect via ICMP -1 1048978 NETWORK Reserved for Security (Type 19) connect via ICMP -1 1048980 NETWORK Router Advertisement connect via ICMP -1 1048981 NETWORK Router Selection connect via ICMP -1 1048982 NETWORK SKIP connect via ICMP -1 1048985 NETWORK Time-To-Live Exceeded in Transit connect via ICMP -1 1048987 NETWORK Timestamp Reply connect via ICMP -1 1048989 NETWORK Timestamp Request connect via ICMP -1 1048991 NETWORK Traceroute ipopts connect via ICMP -1 1049008 NETWORK Large ICMP Packet via ICMP -1 1049016 TERMINAL PCAnywhere Attempted Administrator login via TCP -1 1049021 TERMINAL PCAnywhere Failed login via TCP -1 1049071 TERMINAL PCAnywhere server response access via UDP -1 1050288 NETWORK source route - lsrr connect via ICMP -1 1050290 NETWORK sourceroute-ssrr connect via ICMP -1 1050714 MAIL IMAP4 login via TCP -1 1050946 FILE FTP transfer-upload via TCP -1 1050947 FILE FTP transfer-download via TCP -1 1050955 FILE FTP User login via TCP -1 1050956 FILE FTP PASS command communicate via TCP -1 1050957 MAIL POP3 PASS communicate via TCP -1 1050958 MAIL POP3 User login via TCP -1 1051212 P2P Gnutella transfer via TCP -1 1051213 P2P DirectConnect transfer via TCP -1 1051254 P2P FastTrack transfer via TCP -1 1051685 P2P eDonkey login server via TCP -1 1051701 TUNNEL VNN Client login via UDP -1 1051738 WEB ActiveX Control transfer via TCP -1 1051783 P2P Gnutella connect via TCP -1 1051785 P2P Gnutella ping communicate via UDP -1 1051820 WEB Java Applet transfer via TCP -1 1051821 WEB Java Applet transfer via TCP -2 1051825 MEDIA Windows Media Player media via TCP -2 1051826 MEDIA Windows Media Player media via TCP -3 1051827 MEDIA Windows Media Player media via TCP -4 1051870 WEB Java Applet transfer via TCP -3 1051873 IM Rediff BOL login via TCP -1 1051874 IM Rediff BOL communicate via TCP -1 1051875 IM Rediff BOL transfer via TCP -1 1051876 IM Rediff BOL media-audio via TCP -1 1051877 IM Rediff BOL communicate via TCP -2 1051900 P2P DirectConnect $Supports access via TCP -1 1051901 P2P DirectConnect access via TCP -1 1051904 P2P FastTrack ping communicate via UDP -1 1051998 P2P eDonkey Hello communicate via TCP -1 1052024 P2P eDonkey Request parts communicate via TCP -1 1052032 IM QQ/TM login via TCP -4 1052034 IM Rediff BOL login via TCP -2 1052039 P2P Gnutella communicate via TCP -1 1052056 IM QQ/TM transfer via TCP -1 1052057 IM QQ/TM transfer via UDP -1 1052058 P2P eDonkey Hello answer communicate via TCP -2 1052059 IM QQ/TM transfer via UDP -2 1052062 IM QQ/TM media-audio via TCP -1 1052080 WEB ActiveX Control transfer via TCP -2 1052081 WEB ActiveX Control transfer via TCP -3 1052082 WEB ActiveX Control transfer via TCP -4 1052093 VOIP NetMeeting whiteboard service access via TCP -1 1052108 TERMINAL PcAnywhere Access Port-5631 connect via TCP -1 1052290 TUNNEL TinyVPN login via TCP -1 1052292 P2P Thunder transfer via TCP -2 1052582 MEDIA MP3 file media via TCP -1 1052603 IM Gadu-Gadu login via TCP -1 1052607 IM Rediff BOL login via TCP -3 1052622 IM QQ/TM transfer via UDP -4 1052637 P2P Gnutella-Foxy communicate via TCP-1 1052668 TUNNEL Ping Tunnel connect via ICMP -1 1052681 P2P Thunder transfer via TCP -3 1052684 P2P Thunder transfer via TCP -4 1052692 P2P Vagaa access via UDP -1 1052693 P2P Vagaa access via UDP -2 1052694 P2P Vagaa transfer via TCP -1 1052734 P2P FastTrack transfer via TCP -2 1052808 P2P Thunder transfer via TCP -5 1052833 P2P Gnutella transfer via UDP -1 1052835 IM QQ/TM login via TCP -11 1052836 IM QQ/TM login via TCP -12 1052838 IM QQ/TM transfer via UDP -6 1052849 NETWORK NETBIOS SMB Empty Password Failed access via TCP -1 1052857 TUNNEL VNN Client login via UDP -2 1052881 P2P Thunder transfer via TCP -6 1052887 P2P eDonkey-easyMule access via UDP -1 1052918 MEDIA Windows Media Player media via TCP -5 1052993 P2P Ares access via TCP -2 1052994 P2P Ares access via UDP -1 1053017 P2P Thunder transfer via TCP -9 1053043 TUNNEL HTTP Proxy Server communicate via TCP -1 1053195 MEDIA FLV file media via TCP -1 1053196 IM Wlt login via TCP -1 1053198 IM Jabber-UcTalk/UTGame login via UDP -5 1053199 IM Paltalk login via TCP -1 1053205 IM Gadu-Gadu login via TCP -2 1053218 IM WinpopupX login via UDP -1 1053221 IM Pidgin access via TCP -1 1053222 IM QQ/TM login via UDP -2 1053225 P2P eDonkey-easyMule access via TCP -1 1053228 IM Jabber-UcTalk/UTGame login via UDP -1 1053229 GAME Sina Web login via TCP -1 1053249 GAME WoW login via TCP -1 1053268 IM Jabber-UcTalk/UTGame login via TCP -2 1053273 MEDIA FLV file media via TCP -2 1053296 P2P Thunder access via TCP -1 1053297 P2P Thunder access via TCP -2 1053298 P2P Thunder access via TCP -3 1053299 P2P Thunder access via TCP -4 1053310 TUNNEL VNN Client login via TCP -1 1053367 P2P BT-BitComet transfer via TCP -1 1053409 TERMINAL PCAnywhere connect via TCP -1 1053423 IM QQ/TM transfer via UDP -7 1053426 P2P Gnutella-Foxy communicate via TCP-4 1053432 IM QQ/TM login via UDP -3 1053447 IM Jabber-UcTalk/UTGame login via UDP -4 1053449 P2P QQDownload transfer via TCP -2 1053461 IM Caihong login via TCP -1 1053609 IM Fetion communicate via TCP -1 1053624 IM Jabber-UcTalk/UTGame login via UDP -3 1053641 IM Fetion login via SSL -1 1053643 IM Fetion transfer via TCP -1 1053644 IM Fetion transfer via TCP -2 1053645 IM Fetion communicate via TCP -2 1053650 IM Fetion media-audio via TCP -1 1053656 IM QQ/TM login via UDP -5 1053701 IM Digsby login via TCP -1 1053702 IM Heyyo login via TCP -1 1053708 IM Alicall login via UDP -1 1053709 IM Alicall login via TCP -1 1053830 TUNNEL Freegate login via UDP -1 1053831 TUNNEL Freegate login via TCP -1 1053832 TUNNEL Freegate login via TCP -2 1053836 TUNNEL Freegate login via TCP -3 1053862 P2P Ares access via UDP -2 1053869 AP State - TUNNEL Freegate http request fragment evasion 0-1 1053872 IM Fetion login via SSL -2 1053877 P2P QQDownload transfer via TCP -4 1053907 P2P Gnutella-Foxy transfer via UDP-1 1054145 P2P Ares access via TCP -3 1054147 P2P Ares access via UDP -3 1054152 P2P BT-Vuze communicate via TCP -1 1054153 P2P BT-Vuze communicate via TCP -2 1059684 MISC Bitcoin/LiteCoin/Dogecoin Mining Activity -1 1060229 TERMINAL MS RDP communicate via TCP -1 1061635 P2P QQDownload transfer via TCP -1 1061637 P2P QQDownload transfer via TCP -3 1061710 P2P eDonkey-easyMule access via TCP -2 1061726 P2P eDonkey-easyMule access via UDP -2 1061727 P2P eDonkey-easyMule access via UDP -3 1061734 GAME WOW login via TCP -2 1061739 P2P BT-Vuze communicate via TCP -3 1061777 MEDIA WebStreaming audio media via TCP -1 1061780 TUNNEL Freegate login via TCP -4 1061806 AP State Flow- TUNNEL Freegate http request fragment evasion 1-F/Flow 1061816 IM Fetion login via TCP -3 1062439 MEDIA WebStreaming video media via TCP -1 1063205 P2P BT-BitComet connect via TCP -1 1063211 P2P eDonkey-eMule/Vagaa Version Check via TCP -1 1063215 P2P Gnutella-Foxy communicate via TCP-5 1063224 P2P Thunder Series Version Check via TCP -1 1063225 P2P BT-BitSpirit access via TCP -1 1063290 P2P BT-Vuze communicate via UDP -2 1063356 GAME WoW communicate via TCP -2 1063364 MEDIA TudouVa communicate via TCP -1 1063365 MEDIA TudouVa communicate via TCP -2 1063390 GAME Sina Web login via TCP -2 1063392 IM Fetion login via TCP -4 1063393 IM Fetion login via TCP -5 1063394 IM Fetion media-audio via TCP -2 1063395 IM Fetion media-video via TCP -3 1063430 IM Jaber-UcTalk/UTGame media-audio via TCP -1 1063431 IM Jaber-UcTalk/UTGame media-video via TCP -1 1063432 IM Jaber-UcTalk/UTGame transfer via TCP -1 1063433 P2P QQDownload transfer via TCP -5 1063455 IM QQ/TM transfer via UDP -8 1063456 IM QQ/TM transfer via TCP -5 1063483 IM QQ/TM transfer via UDP -9 1063499 IM Fetion transfer via TCP -3 1063517 NETWORK Multicast DNS query access via UDP -1 1063543 MAIL Pchome login via SSL -1 1063544 WEB RSS access via TCP -1 1063584 NETWORK UPnP access via UDP -1 1063585 NETWORK UPnP access via UDP -2 1063586 NETWORK UPnP access via TCP -1 1063587 IM Digsby login via TCP -2 1064000 TUNNEL Freegate login via UDP -2 1064020 IM Alicall login via TCP -2 1064021 IM Alicall login via TCP -3 1064054 NETWORK SNMP public access UDP -1 1064055 NETWORK SNMP public access TCP -1 1064056 NETWORK SNMP private access UDP -1 1064057 NETWORK SNMP private access via TCP -1 1064063 IM Digsby login via TCP -3 1064162 IM QQ/TM login via UDP -1 1064188 P2P eDonkey-easyMule access via SSL -1 1064191 P2P BT-BitComet transfer via TCP -2 1064192 IM QQ/TM login via TCP -2 1064372 IM QQ/TM login via TCP -5 1064373 IM QQ/TM login via UDP -4 1064377 TUNNEL Freegate login via UDP -3 1064378 TUNNEL Freegate login via UDP -4 1064399 TUNNEL VNN Client login via TCP -2 1064406 IM Paltalk login via TCP -2 1064983 TUNNEL Freegate login via UDP -5 1064984 TUNNEL Freegate login via UDP -6 1064985 TUNNEL Freegate login via UDP -7 1064986 TUNNEL Freegate login via UDP -8 1065490 P2P QQDownload transfer via TCP -6 1065491 P2P QQDownload transfer via UDP -1 1065492 P2P QQDownload transfer via TCP -7 1065502 P2P Ares access via TCP -4 1065503 P2P Ares media via TCP -3 1065535 IM QQ/TM transfer via TCP -6 1065710 P2P BT-Vuze communicate via TCP -4 1065784 WEB Yahoo Slurp crawler access via TCP -1 1065787 WEB Microsoft bingbot crawler access via TCP -1 1065788 WEB Googlebot crawler access via TCP -1 1065789 WEB Googlebot crawler access via TCP -2 1065790 WEB Googlebot crawler access via TCP -3 1065791 WEB Abot crawler access via TCP -1 1065792 WEB HTTrack crawler access via TCP -1 1065793 WEB Win Web Crawler access via TCP -1 1065794 WEB ZoomSpider crawler access via TCP -1 1065834 TUNNEL Freegate login via UDP -9 1066057 IM Alicall login via TCP -4 1066058 IM Alicall access via TCP -1 1066059 IM Alicall access via TCP -2 1066068 MEDIA TudouVa communicate via TCP -3 1066232 P2P Thunder access via TCP -5 1066388 IM Fetion transfer via TCP -4 1067142 IM Fetion login via TCP -6 1067143 IM Fetion transfer via TCP -5 1067144 IM Fetion media-video via TCP -4 1067272 P2P QQDownload access via TCP -1 1067436 TUNNEL VNN Client login via TCP -3 1067543 IM QQ/TM media-audio via TCP -2 1067544 IM QQ/TM media-video via TCP -1 1067580 IM QQ/TM media-video via UDP -1 1067612 P2P Thunder transfer via TCP -7 1067737 TERMINAL pcAnywhere connect via TCP -2 1067740 P2P Thunder transfer via TCP -8 1067741 MEDIA MP3 file media via TCP -2 1067851 IM QQ/TM media via UDP -1 1068063 P2P Thunder transfer via TCP -11 1068268 TERMINAL MS RDP communicate via TCP -2 1068269 TERMINAL MS RDP communicate via TCP -3 1068327 MEDIA WebStreaming mkv media via TCP -1 1068328 MEDIA WebStreaming mkv media via TCP -2 1068745 TERMINAL MS RDP communicate via UDP -1 1068889 GAME WOW transfer via TCP -1 1069104 P2P Ares access via TCP -5 1069622 WEB HTTP access via TCP -3 1080019 SG - TUNNEL Freegate login via TCP/UDP 1132543 WEB Apache Struts Dynamic Method Invocation Remote Code Execution -1.h 1133079 WEB-CLIENT Microsoft Edge CVE-2016-3386 Memory Corruption (CVE-2016-3386) 1133189 MISC Bitcoin/LiteCoin/Dogecoin Mining Activity -2 1160102 IM Gadu-Gadu access via SSL -1 Deleted 0 rule(s): ---------------