Rule Update

21-005 (February 2, 2021)


* indicates a new version of an existing rule

Deep Packet Inspection Rules:

DNS Client
1010744 - DNS Request To Ngrok Domain Detected
1010740 - DNSmasq DNSSEC Heap Based Buffer Overflow Vulnerability (CVE-2020-25681)

DNS Server
1004747* - DNS Invalid Compression Denial Of Service

Directory Server LDAP
1010667* - Microsoft Windows Active Directory IntegratedDNS Remote Code Execution Vulnerability (CVE-2020-0761)
1010321* - OpenLDAP slapd Nested Filter Stack Overflow Vulnerability (CVE-2020-12243)

FTP Server IIS
1004553* - Microsoft IIS FTPSVC Unspecified Remote Denial Of Service

Java RMI
1009390* - Apache Commons FileUpload DiskFileItem File Manipulation Remote Code Execution Vulnerability (CVE-2016-1000031)

1010745 - Memcached 'process_bin_sasl_auth' Integer Overflow Vulnerability (CVE-2016-8706)

Suspicious Client Application Activity
1010741* - Identified HTTP Backdoor Python FreakOut A Runtime Detection

Unix Samba
1008847* - Samba Information Disclosure Vulnerability (CVE-2017-15275)

Web Application Common
1010750 - Zend Framework Deserialization Remote Code Execution Vulnerability (CVE-2021-3007)

Web Client Common
1008753 - GNU Wget 'fd_read_body' Heap Buffer Overflow Vulnerability (CVE-2017-13090)
1008750 - GNU Wget 'skip_short_body' Stack Buffer Overflow Vulnerability (CVE-2017-13089)

Web Server Apache
1010461* - Apache Struts2 Remote Code Execution Vulnerability (CVE-2019-0230)

Web Server Common
1010725 - Pi-Hole Remote Command Execution Vulnerability (CVE-2020-8816)
1010755 - SAP Solution Manager Remote Code Execution Vulnerability (CVE-2020-6207)

Web Server Miscellaneous
1010753 - Atlassian Jira Server-Side Request Forgery Vulnerability (CVE-2019-8451)

Web Server Oracle
1010752 - Oracle Coherence Server T3 Protocol Insecure Deserialization Vulnerability (CVE-2020-14756)
1010739* - Oracle WebLogic Console JNDI Injection Vulnerability (CVE-2021-2109)

Web Server SharePoint
1010738 - Restrict Attempt To Enumerate Microsoft SharePoint For User Accounts (ATT&CK T1087)

Integrity Monitoring Rules:

1010055* - AntiVirus - Trend Micro ApexOne Server
1003744* - AntiVirus - Trend Micro OfficeScan Server

Log Inspection Rules:

There are no new or updated Log Inspection Rules in this Security Update.