Trend Micro Deep Security™️およびDPIルール等の関連情報

  • * は既存ルールの新バージョンを示します。

    DPI(Deep Packet Inspection) ルール:

    DCERPCサービス – クライアント
    1008915* - Microsoft Windows SMBv3 Denial Of Service Vulnerability (CVE-2018-0833)


    DHCPv6サーバ
    1008668 - Dnsmasq Information Leak Vulnerability (CVE-2017-14494)


    HP Intelligent Management Center (IMC)
    1008709* - HPE Intelligent Management Center 'getSelInsBean' Expression Language Injection Vulnerability (CVE-2017-12490)
    1008718 - HPE Intelligent Management Center 'userSelectPagingContent' Expression Language Injection Vulnerability (CVE-2017-12521)
    1008797* - HPE Operations Orchestration Backwards-Compatibility Beanutils Deserialization Vulnerability (CVE-2017-8994)
    1008687* - HPE Operations Orchestration Central-Remoting Insecure Deserialization Vulnerability (CVE-2017-8994)
    1008765* - Hewlett Packard Enterprise Intelligent Management Center Language Injection Remote Code Execution Vulnerabilities


    HP Network Automation
    1008677 - HPE Network Automation PermissionFilter Authentication Bypass Vulnerability (CVE-2017-5812)


    HP OpenView
    1004786* - HP Data Protector Client EXEC_CMD Perl Remote Code Execution Vulnerability


    Mailクライアント Windows
    1001190* - Microsoft Windows Explorer WMF File Denial Of Service.
    1001269* - Microsoft Windows Media Format ASF Parsing Remote Code Execution (CVE-2007-0064)


    Mailサーバ Exim
    1008940* - Exim Buffer Overflow Remote Code Execution Vulnerability (CVE-2018-6789)


    RADIUSサーバ
    1008816 - FreeRADIUS 'rad_coalesce' Out Of Bounds Read Vulnerability (CVE-2017-10979)


    Remote Desktop Protocol Server
    1007969* - Identified Suspicious Remote Desktop Protocol (RDP) Brute Force Attempt


    アプリケーションに関連する不審な活動(クライアント)
    1008946 - Heuristic Detection Of Suspicious Digital Certificate


    ランサムウェアに関連する不審な活動(クライアント)
    1007706* - Ransomware Network Traffic - 3


    Symantec Messaging Gateway
    1008575* - Symantec Messaging Gateway Unauthenticated Remote Code Execution Vulnerability (CVE-2017-6327)


    VoIP Smart
    1008846* - Digium Asterisk PJSIP Contact Header Denial Of Service Vulnerability (CVE-2017-17850)


    VoIP Soft Phones
    1006537* - Asterisk Open Source SIP SUBSCRIBE Request Denial Of Service Vulnerability


    Webアプリケーション 共通
    1005936* - Identified Local File Inclusion (LFI) Over HTTP


    Webアプリケーション PHP
    1008041* - Drupal Coder Module Remote Code Execution Vulnerability
    1006386* - PHP 'unserialize()' Integer Overflow Vulnerability (CVE-2014-3669)
    1008863 - PHP Openssl Extension PEM Sealing Denial Of Service Vulnerability (CVE-2017-11144)
    1008893 - PHP ZIP Signature Verification Out Of Bound Memory Access Vulnerability (CVE-2016-7414)
    1008664* - PHP finish_nested_data Function Heap Buffer Overflow Vulnerability (CVE-2017-12933)


    Webクライアント 共通
    1008886* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB18-02) - 3
    1008889* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB18-02) - 4
    1007515* - Adobe Flash Player Heap Overflow Vulnerability (CVE-2016-1001)
    1008854* - Adobe Flash Player Remote Code Execution Vulnerability (CVE-2018-4878)
    1007507* - Adobe Flash Player Use After Free Vulnerability (CVE-2016-0988)
    1007014* - Adobe Reader And Acrobat Heap Based Buffer Overflow Vulnerability (CVE-2015-5105)
    1008719 - Foxit Reader PDF Parsing Multiple Out Of Bounds Read Information Disclosure Vulnerabilities
    1008410* - Microsoft .NET Framework Pointer Verification Vulnerability (CVE-2009-0090)
    1008903 - Microsoft Windows EOT Font Engine Information Disclosure Vulnerability (CVE-2018-0761)
    1008172* - Microsoft Windows Kernel Elevation Of Privilege Vulnerability (CVE-2017-0050)
    1001248* - Microsoft Windows Media Format ASF Parsing Remote Code Execution
    1008448* - Microsoft Windows Multiple Elevation Of Privilege Vulnerabilities (June-2017)
    1008341* - Microsoft Windows Multiple Security Vulnerabilities (May-2017)
    1008521* - Microsoft Windows PDF Remote Code Execution Vulnerability (CVE-2017-0291)
    1008892 - PHP ZIP Signature Verification Out Of Bound Memory Access Vulnerability (CVE-2016-7414) - 1


    Webクライアント Internet Explorer/Edge
    1004986* - Dell Webcam Central CrazyTalk4 ActiveX Control Buffer Overflow Vulnerability
    1007470* - Microsoft Internet Explorer And Edge Memory Corruption Vulnerability (CVE-2016-0105)
    1005784* - Microsoft Internet Explorer Information Disclosure Vulnerability (CVE-2013-3908)
    1006749* - Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-1732)
    1006750* - Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-1733)
    1006751* - Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-1735)
    1008881* - Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2018-0866)
    1008796* - Microsoft Internet Explorer Scripting Engine Information Disclosure Vulnerability (CVE-2017-11906)


    Webクライアント Mozilla Firefox
    1008579* - Mozilla Firefox Use-After-Free Vulnerability (CVE-2016-1960)


    Webクライアント SSL
    1008528 - Squid Proxy Incorrect X509 Server Certificate Validation Vulnerability (CVE-2015-3455)


    Webサーバ 共通
    1005434* - Disallow Upload Of A PHP File
    1007185* - Java Unserialize Remote Code Execution Vulnerability


    Webサーバ その他
    1008840* - Apache CouchDB '_config' Command Execution Vulnerability (CVE-2017-12636)
    1008751* - Apache CouchDB Remote Code Execution Vulnerabilities (CVE-2017-12635)
    1008843* - FasterXML Jackson JSON Library Deserializer Multiple Remote Code Execution Vulnerabilities
    1007522* - JBoss Seam Parameterized EL Expressions Remote Code Execution Vulnerability
    1002947* - Mambo CMS File Inclusion Vulnerability Scan (CVE-2005-3738)
    1008527* - Nginx ngx_http_range_filter_module Integer Overflow Vulnerability (CVE-2017-7529)
    1007060* - Red Hat JBoss RichFaces Remote Code Execution Vulnerability (CVE-2015-0279)


    Windows Mediaサーバ
    1004097* - Media Services Stack-based Buffer Overflow Vulnerability


    変更監視(Integrity Monitoring)ルール:

    今回のセキュリティアップデートには、新規の変更監視ルールおよび更新は含まれておりません。


    セキュリティログ監視(Log Inspection)ルール:

    1003802* - Directory Server – Microsoft Windows Active Directory
  • * は既存ルールの新バージョンを示します。

    DPI(Deep Packet Inspection) ルール:

    DCERPCサービス – クライアント
    1008915* - Microsoft Windows SMBv3 Denial Of Service Vulnerability (CVE-2018-0833)


    DHCPv6サーバ
    1008668 - Dnsmasq Information Leak Vulnerability (CVE-2017-14494)


    HP Intelligent Management Center (IMC)
    1008709* - HPE Intelligent Management Center 'getSelInsBean' Expression Language Injection Vulnerability (CVE-2017-12490)
    1008718 - HPE Intelligent Management Center 'userSelectPagingContent' Expression Language Injection Vulnerability (CVE-2017-12521)
    1008797* - HPE Operations Orchestration Backwards-Compatibility Beanutils Deserialization Vulnerability (CVE-2017-8994)
    1008687* - HPE Operations Orchestration Central-Remoting Insecure Deserialization Vulnerability (CVE-2017-8994)
    1008765* - Hewlett Packard Enterprise Intelligent Management Center Language Injection Remote Code Execution Vulnerabilities


    HP Network Automation
    1008677 - HPE Network Automation PermissionFilter Authentication Bypass Vulnerability (CVE-2017-5812)


    HP OpenView
    1004786* - HP Data Protector Client EXEC_CMD Perl Remote Code Execution Vulnerability


    Mailクライアント Windows
    1001190* - Microsoft Windows Explorer WMF File Denial Of Service.
    1001269* - Microsoft Windows Media Format ASF Parsing Remote Code Execution (CVE-2007-0064)


    Mailサーバ Exim
    1008940* - Exim Buffer Overflow Remote Code Execution Vulnerability (CVE-2018-6789)


    RADIUSサーバ
    1008816 - FreeRADIUS 'rad_coalesce' Out Of Bounds Read Vulnerability (CVE-2017-10979)


    Remote Desktop Protocol Server
    1007969* - Identified Suspicious Remote Desktop Protocol (RDP) Brute Force Attempt


    アプリケーションに関連する不審な活動(クライアント)
    1008946 - Heuristic Detection Of Suspicious Digital Certificate


    ランサムウェアに関連する不審な活動(クライアント)
    1007706* - Ransomware Network Traffic - 3


    Symantec Messaging Gateway
    1008575* - Symantec Messaging Gateway Unauthenticated Remote Code Execution Vulnerability (CVE-2017-6327)


    VoIP Smart
    1008846* - Digium Asterisk PJSIP Contact Header Denial Of Service Vulnerability (CVE-2017-17850)


    VoIP Soft Phones
    1006537* - Asterisk Open Source SIP SUBSCRIBE Request Denial Of Service Vulnerability


    Webアプリケーション 共通
    1005936* - Identified Local File Inclusion (LFI) Over HTTP


    Webアプリケーション PHP
    1008041* - Drupal Coder Module Remote Code Execution Vulnerability
    1006386* - PHP 'unserialize()' Integer Overflow Vulnerability (CVE-2014-3669)
    1008863 - PHP Openssl Extension PEM Sealing Denial Of Service Vulnerability (CVE-2017-11144)
    1008893 - PHP ZIP Signature Verification Out Of Bound Memory Access Vulnerability (CVE-2016-7414)
    1008664* - PHP finish_nested_data Function Heap Buffer Overflow Vulnerability (CVE-2017-12933)


    Webクライアント 共通
    1008886* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB18-02) - 3
    1008889* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB18-02) - 4
    1007515* - Adobe Flash Player Heap Overflow Vulnerability (CVE-2016-1001)
    1008854* - Adobe Flash Player Remote Code Execution Vulnerability (CVE-2018-4878)
    1007507* - Adobe Flash Player Use After Free Vulnerability (CVE-2016-0988)
    1007014* - Adobe Reader And Acrobat Heap Based Buffer Overflow Vulnerability (CVE-2015-5105)
    1008719 - Foxit Reader PDF Parsing Multiple Out Of Bounds Read Information Disclosure Vulnerabilities
    1008410* - Microsoft .NET Framework Pointer Verification Vulnerability (CVE-2009-0090)
    1008903 - Microsoft Windows EOT Font Engine Information Disclosure Vulnerability (CVE-2018-0761)
    1008172* - Microsoft Windows Kernel Elevation Of Privilege Vulnerability (CVE-2017-0050)
    1001248* - Microsoft Windows Media Format ASF Parsing Remote Code Execution
    1008448* - Microsoft Windows Multiple Elevation Of Privilege Vulnerabilities (June-2017)
    1008341* - Microsoft Windows Multiple Security Vulnerabilities (May-2017)
    1008521* - Microsoft Windows PDF Remote Code Execution Vulnerability (CVE-2017-0291)
    1008892 - PHP ZIP Signature Verification Out Of Bound Memory Access Vulnerability (CVE-2016-7414) - 1


    Webクライアント Internet Explorer/Edge
    1004986* - Dell Webcam Central CrazyTalk4 ActiveX Control Buffer Overflow Vulnerability
    1007470* - Microsoft Internet Explorer And Edge Memory Corruption Vulnerability (CVE-2016-0105)
    1005784* - Microsoft Internet Explorer Information Disclosure Vulnerability (CVE-2013-3908)
    1006749* - Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-1732)
    1006750* - Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-1733)
    1006751* - Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-1735)
    1008881* - Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2018-0866)
    1008796* - Microsoft Internet Explorer Scripting Engine Information Disclosure Vulnerability (CVE-2017-11906)


    Webクライアント Mozilla Firefox
    1008579* - Mozilla Firefox Use-After-Free Vulnerability (CVE-2016-1960)


    Webクライアント SSL
    1008528 - Squid Proxy Incorrect X509 Server Certificate Validation Vulnerability (CVE-2015-3455)


    Webサーバ 共通
    1005434* - Disallow Upload Of A PHP File
    1007185* - Java Unserialize Remote Code Execution Vulnerability


    Webサーバ その他
    1008840* - Apache CouchDB '_config' Command Execution Vulnerability (CVE-2017-12636)
    1008751* - Apache CouchDB Remote Code Execution Vulnerabilities (CVE-2017-12635)
    1008843* - FasterXML Jackson JSON Library Deserializer Multiple Remote Code Execution Vulnerabilities
    1007522* - JBoss Seam Parameterized EL Expressions Remote Code Execution Vulnerability
    1002947* - Mambo CMS File Inclusion Vulnerability Scan (CVE-2005-3738)
    1008527* - Nginx ngx_http_range_filter_module Integer Overflow Vulnerability (CVE-2017-7529)
    1007060* - Red Hat JBoss RichFaces Remote Code Execution Vulnerability (CVE-2015-0279)


    Windows Mediaサーバ
    1004097* - Media Services Stack-based Buffer Overflow Vulnerability


    変更監視(Integrity Monitoring)ルール:

    今回のセキュリティアップデートには、新規の変更監視ルールおよび更新は含まれておりません。


    セキュリティログ監視(Log Inspection)ルール:

    1003802* - Directory Server – Microsoft Windows Active Directory
  • * は既存ルールの新バージョンを示します。

    DPI(Deep Packet Inspection) ルール:

    HP Intelligent Management Center (IMC)
    1008709 - HPE Intelligent Management Center 'getSelInsBean' Expression Language Injection Vulnerability (CVE-2017-12490)
    1008765 - Hewlett Packard Enterprise Intelligent Management Center Language Injection Remote Code Execution Vulnerabilities


    HP Intelligent Management Center Dbman
    1008790* - HPE Intelligent Management Center dbman Opcode 10012 Use-After-Free Remote Code Execution Vulnerability (CVE-2017-12561)


    Instant Messenger Applications
    1002163* - Yahoo! Messenger


    Mailサーバ Exim
    1008940 - Exim Buffer Overflow Remote Code Execution Vulnerability (CVE-2018-6789)


    Microsoft Office
    1008931 - Microsoft Office Memory Corruption Vulnerability (CVE-2018-0922)


    OpenSSL
    1006302* - OpenSSL TLS/DTLS SRTP Memory Leak Denial Of Service Vulnerability (CVE-2014-3513)


    VoIP Smart
    1008846 - Digium Asterisk PJSIP Contact Header Denial Of Service Vulnerability (CVE-2017-17850)


    Webアプリケーション PHP
    1008884* - PHP 'unserialize()' Function Denial Of Service Vulnerability (CVE-2015-4602)
    1008890* - PHP 'unserialize()' Function Type Confusion Vulnerability (CVE-2015-4603)
    1008664 - PHP finish_nested_data Function Heap Buffer Overflow Vulnerability (CVE-2017-12933)


    Webクライアント 共通
    1008745* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB17-36) - 4
    1008939 - Adobe Flash Player Multiple Security Vulnerabilities (APSB18-05)
    1008829 - Foxit Reader Multiple Information Disclosure Vulnerabilities
    1008762 - Git SSH URL Processing Command Execution Vulnerability (CVE-2017-1000117)
    1004085* - Heuristic Detection Of Malicious PDF Documents - 3
    1008930 - Microsoft Access Remote Code Execution Vulnerability (CVE-2018-0903)
    1008897 - Microsoft Windows EOT Font Engine Information Disclosure Vulnerability (CVE-2018-0855)
    1008936 - Microsoft Windows Multiple Elevation Of Privilege Vulnerabilities (March-2018)


    Webクライアント Internet Explorer/Edge
    1008826* - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0758)
    1008900 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0770)
    1008922 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0872)
    1008923 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0874)
    1008929 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0893)
    1008932 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0930)
    1008933 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0933)
    1008934 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0934)
    1008935 - Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2018-0935)
    1008928 - Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2018-0889)


    Webサーバ 共通
    1000131* - HTTP Header Length Restriction
    1005728* - Parameter Value Length Restriction


    Webサーバ その他
    1008794* - Apache Struts2 Jackson JSON Library Deserializer Remote Code Execution Vulnerability (CVE-2017-7525)
    1008527 - Nginx ngx_http_range_filter_module Integer Overflow Vulnerability (CVE-2017-7529)


    変更監視(Integrity Monitoring)ルール:

    今回のセキュリティアップデートには、新規の変更監視ルールおよび更新は含まれておりません。


    セキュリティログ監視(Log Inspection)ルール:

    今回のセキュリティアップデートには、新規のセキュリティログ監視ルールおよび更新は含まれておりません。
  • * indicates a new version of an existing rule

    Deep Packet Inspection Rules:

    DCERPC Services - Client
    1008915 - Microsoft Windows SMBv3 Denial Of Service Vulnerability (CVE-2018-0833)


    Web Client Common
    1008889* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB18-02) - 4


    Integrity Monitoring Rules:

    1002999* - Database Server - Microsoft SQL Server


    Log Inspection Rules:

    There are no new or updated Log Inspection Rules in this Security Update.
  • * indicates a new version of an existing rule

    Deep Packet Inspection Rules:

    Memcached
    1008916 - Identified Memcached Reflected UDP Traffic


    Suspicious Server Application Activity
    1008918 - Identified Memcached Amplified Reflected Response


    Integrity Monitoring Rules:

    There are no new or updated Integrity Monitoring Rules in this Security Update.


    Log Inspection Rules:

    There are no new or updated Log Inspection Rules in this Security Update.
  • * indicates a new version of an existing rule

    Deep Packet Inspection Rules:

    DCERPC Services
    1000735* - Microsoft Windows Server Service Remote Code Execution


    DNS Server
    1000167* - Snort Back Orifice Pre-Processor Buffer Overflow


    Kerberos KDC Server
    1003977* - Kerberos Null Pointer Dereference Vulnerability


    Mail Server Common
    1005344* - POP3 Mail Server Possible Brute Force Attempt


    Mail Server Microsoft Exchange
    1002629* - Microsoft Outlook Web Access For Exchange Server Cross Site Scripting


    Web Application PHP Based
    1005654* - PHP 'com_print_typeinfo()' Remote Code Execution Vulnerability
    1008884 - PHP 'unserialize()' Function Denial Of Service Vulnerability (CVE-2015-4602)
    1008890 - PHP 'unserialize()' Function Type Confusion Vulnerability (CVE-2015-4603)


    Web Application Perl Based
    1000095* - Lupii/Lupper Worm Vulnerabilities (AwStats)


    Web Client Common
    1008743* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB17-36) - 3
    1008738* - Adobe Flash Player Multiple Security Vulnerabilities (APSB17-33)
    1000084* - BlackMal/KamaSutra Worm Counter Request
    1004294* - Identified Microsoft Windows Shortcut File Over WebDav
    1004305* - Identified Suspicious Compiled HTML(chm) File
    1003693* - Mass Compromise Using Malicious iFrame
    1008655* - Microsoft JET Database Engine Remote Code Execution Vulnerability (CVE-2017-8717)
    1008656* - Microsoft JET Database Engine Remote Code Execution Vulnerability (CVE-2017-8718)
    1004404* - Outlook Web Access Elevation Of Privilege Vulnerability


    Web Client Internet Explorer/Edge
    1004205* - Cumulative Security Updates of ActiveX Kill Bits - June 2010
    1004282* - Identified Suspicious Usage Of ACCWIZ.dll ActiveX Control
    1008774* - Microsoft Edge Memory Corruption Vulnerability (CVE-2017-11893)
    1008849 - Microsoft Edge Scripting Engine Information Disclosure Vulnerability (CVE-2018-0780)
    1008821* - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0774)
    1008820* - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0776)
    1008853 - Microsoft Internet Explorer Scripting Engine Information Disclosure Vulnerability (CVE-2017-11887)


    Web Client Mozilla Firefox
    1004112* - Mozilla Firefox Image Preloading Content-Policy Check Security Bypass Vulnerability


    Web Client SSL
    1005222* - Identified RSA Keys Less Than 1024 bits


    Web Server Apache
    1005439* - Apache 'mod_ssl' Log Function Format String Vulnerability
    1000618* - Apache Linux Slapper Worm (.A variant) Probe
    1000853* - Apache mod_tcl Module Format String Vulnerability


    Web Server Common
    1007185* - Java Unserialize Remote Code Execution Vulnerability
    1005553* - Oracle JavaDoc Frame Injection Vulnerability


    iSCSI Framework
    1004269* - iSCSI Target Multiple Implementations iSNS Stack Buffer Overflow


    Integrity Monitoring Rules:

    There are no new or updated Integrity Monitoring Rules in this Security Update.


    Log Inspection Rules:

    There are no new or updated Log Inspection Rules in this Security Update.
  • * indicates a new version of an existing rule

    Deep Packet Inspection Rules:

    Asterisk Server IAX2
    1003778* - Digium Asterisk IAX2 Call Number Denial Of Service


    DCERPC Services
    1000972* - Microsoft Windows svcctl ChangeServiceConfig2A() Memory Corruption Vulnerability
    1005293* - Prevent Windows Administrator User Login Over SMB


    DCERPC Services - Client
    1006784* - Identified Windows Group Policy Files Downloaded From Untrusted Sources


    Directory Server LDAP
    1000086* - CommuniGate Systems CommuniGate Pro LDAP Server Buffer Overflow


    FTP Server Common
    1000914* - FTP Argument Check


    Mail Server Microsoft Exchange
    1002632* - Microsoft Outlook Web Access For Exchange Server HTML Validating Cross Site Scripting


    Oracle Internet Directory
    1003917* - Oracle Internet Directory 'oidldapd' Remote Memory Corruption Vulnerability


    TFTP Server
    1000929* - 3CDaemon Reserved Device Name DoS
    1000876* - Microsoft Windows Remote Installation Service Anonymous File Upload


    Unix CVS
    1000511* - CVS Annotate Command Long Revision String Buffer Overflow
    1000515* - CVS Max-dotdot Command Integer Overflow


    Unix Samba SWAT
    1000525* - Samba SWAT HTTP Authentication Buffer Overflow


    Unix Subversion
    1000519* - Subversion svn Protocol String Parsing Vulnerability


    Web Application PHP Based
    1005664* - PHP 'ip2long' Function String Validation Weakness Vulnerability


    Web Application Tomcat
    1003954* - Apache Tomcat Directory Traversal Weakness
    1003094* - Identified runtime.getRuntime().exec() In HTTP Request


    Web Client Common
    1008891 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB18-02) - 1
    1008883 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB18-02) - 2
    1008886 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB18-02) - 3
    1008889 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB18-02) - 4
    1008885 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB18-02) - 5
    1004010* - FFmpeg Version Multiple Remote Vulnerabilities
    1004308* - Identified PIF File Over HTTP
    1005290* - Identified Suspicious JavaScript iframe Object
    1004301* - Microsoft Office Outlook Web Access For Exchange Server 2003 XSRF Vulnerability
    1004760* - Restrict Web Client Telnet And Remote Login Handlers


    Web Client Internet Explorer/Edge
    1005190* - Identified GE Proficy Historian KeyHelp ActiveX Control With LaunchTriPane Function
    1001250* - Microsoft Internet Explorer HP Compaq Notebooks ActiveX Remote Code Execution
    1004832* - Oracle DataDirect Multiple Native Wire Protocol ODBC Drivers HOST Attribute Stack Based Buffer Overflow Vulnerability


    Web Server Apache
    1004668* - Apache APR 'apr_fnmatch()' Denial Of Service Vulnerability
    1004655* - Apache mod_perl 'path_info' Denial Of Service


    Web Server HTTPS
    1004351* - Detected Malicious HTTP Requests


    Web Server IIS
    1003508* - Microsoft IIS Unicode Requests To WebDAV Authentication Bypass Vulnerability


    Web Server Miscellaneous
    1008751* - Apache CouchDB Remote Code Execution Vulnerabilities (CVE-2017-12635)
    1008794* - Apache Struts2 Jackson JSON Library Deserializer Remote Code Execution Vulnerability (CVE-2017-7525)
    1008843 - FasterXML Jackson JSON Library Deserializer Multiple Remote Code Execution Vulnerabilities


    Web Server Squid
    1000388* - Restrict Squid Cache Manager Access


    Integrity Monitoring Rules:

    There are no new or updated Integrity Monitoring Rules in this Security Update.


    Log Inspection Rules:

    There are no new or updated Log Inspection Rules in this Security Update.
  • * indicates a new version of an existing rule

    Deep Packet Inspection Rules:

    DCERPC Services
    1004808* - Identified Big-Endian Byte Order
    1008560* - Microsoft Windows Search Remote Code Execution Vulnerability (CVE-2017-8620)


    DCERPC Services - Client
    1004293* - Identified Microsoft Windows Shortcut File Over Network Share


    Database Microsoft SQL
    1000917* - Restrict Microsoft SQL Server XP_CMDSHELL Procedure


    Directory Server LDAP
    1005455* - Microsoft Active Directory Memory Consumption Vulnerability (CVE-2013-1282)


    HP Intelligent Management Center (IMC)
    1008764* - HPE Intelligent Management Center Directory Traversal Vulnerabilities


    Microsoft Office
    1004283* - Identified Suspicious Usage Of ACCWIZ.dll ActiveX Control In Microsoft Office Documents
    1008872 - Microsoft Office Remote Code Execution Vulnerability (CVE-2018-0841)
    1005014* - Restrict Microsoft Office File With Embedded EMF
    1005019* - Restrict Microsoft Office File With Linked SWF


    NFS Server
    1008802* - Linux Kernel NFSv4 nfsd PNFS Denial Of Service Vulnerability (CVE-2017-8797)


    Oracle Internet Directory
    1002652* - Oracle Internet Directory Remote Preauthentication DoS
    1003938* - Oracle Internet Directory oidldapd 'gslsbnrNormalizeString' DoS


    TFTP Server
    1000928* - AT-TFTP Server Long Filename Buffer Overflow


    Unix CFEngine
    1000451* - CFEngine CFServD Transaction Packet Buffer Overrun Vulnerability


    Unix dtspcd
    1000433* - Multiple Vendor CDE dtspcd Buffer Overflow Vulnerability


    Web Application Tomcat
    1006107* - Apache Tomcat Chunk Request Remote Denial Of Service Vulnerability
    1001074* - Apache Tomcat Cookie Handling Session ID Disclosure


    Web Client Common
    1008854* - Adobe Flash Player Remote Code Execution Vulnerability (CVE-2018-4878)
    1008878 - Adobe Flash Player Use After Free Remote Code Execution Vulnerability (CVE-2018-4877)
    1003746* - IBM Installation Manager IIM URI Handling Code Execution
    1002443* - IBM Lotus Expeditor URI Handler Command Execution Vulnerability
    1003479* - IceWarp Merak Web Mail Server 'cleanHTML()' Function Cross-Site Scripting Vulnerability
    1002144* - JavaScript IFRAME Redirect Script Insertion Vulnerability
    1002048* - JavaScript Redirect Script Insertion Vulnerability
    1004649* - Microsoft Compiled HTML Help File Stack Overflow Vulnerability
    1008877 - Microsoft Windows Multiple Security Vulnerabilities (Feb-2018)
    1008866 - Microsoft Windows StructuredQuery Remote Code Execution Vulnerability (CVE-2018-0825)


    Web Client Internet Explorer/Edge
    1002964* - Cumulative Security Update of ActiveX Kill Bits - October 2008
    1004020* - Domino Web Access ActiveX Control Unspecified Buffer Overflow Vulnerability
    1004297* - Microsoft Clip Organizer Multiple Insecure ActiveX Control Vulnerability
    1008867 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0834)
    1008868 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0835)
    1008869 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0837)
    1008870 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0838)
    1008873 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0858)
    1008874 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0860)
    1008871 - Microsoft Internet Explorer And Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0840)
    1008881 - Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2018-0866)
    1005192* - Restrict Cisco AnyConnect Secure Mobility Client ActiveX Controls
    1004098* - Restrict Windows Media Player ActiveX Control


    Web Client Mozilla Firefox
    1003580* - Mozilla Firefox Location Bar Spoofing Vulnerability
    1003323* - Mozilla Firefox XBL Script Injection


    Web Client SSL
    1006296* - Detected SSLv3 Response
    1006298* - Identified CBC Based Cipher Suite In SSLv3 Request


    Web Server Apache
    1000640* - Apache Geronimo Web Access log Viewer Scripts Insertion


    Web Server IIS
    1005076* - Detected Microsoft Windows Short File/Dir Names Over HTTP
    1004887* - Microsoft .NET Framework Forms Authentication URI Spoofing Vulnerability (CVE-2011-3415)
    1005622* - Microsoft Internet Information Services DOS Device Request Security Bypass Vulnerability


    Web Server Miscellaneous
    1008747* - Adobe ColdFusion RMI Registry Insecure Deserialization (CVE-2017-11284)
    1008840 - Apache CouchDB '_config' Command Execution Vulnerability (CVE-2017-12636)


    Integrity Monitoring Rules:

    There are no new or updated Integrity Monitoring Rules in this Security Update.


    Log Inspection Rules:

    1008852 - Auditd
    1004057* - Microsoft Windows Security Events - 1
    1008670* - Microsoft Windows Security Events - 3
  • * indicates a new version of an existing rule

    Deep Packet Inspection Rules:

    DCERPC Services
    1003984* - SMB NTLM Authentication Lack Of Entropy Vulnerability


    DCERPC Services - Client
    1008577 - Microsoft Visio OLE DLL Loading Arbitrary Code Execution Vulnerability Over Network Share (CVE-2016-3235)


    Database MySQL
    1004901* - Identified Suspicious Remote Login To MySQL Server Without Password


    HP Intelligent Management Center (IMC)
    1008764 - HPE Intelligent Management Center Directory Traversal Vulnerabilities


    Trend Micro OfficeScan
    1001050* - Trend Micro OfficeScan Server CGI Module Authentication Bypass


    Web Application PHP Based
    1008858 - Identified Access To 'wp-admin' Directory
    1005725* - PHP 'phar_parse_tarfile' Function Integer Overflow
    1005915* - phpLDAPadmin 'query_engine' Remote PHP Code Injection Vulnerability
    1005947* - phpMyAdmin 'setup.php' PHP Code Injection Vulnerability


    Web Application Tomcat
    1001108* - Apache Tomcat Cookie Handling Single Quotes Vulnerability


    Web Client Common
    1008854* - Adobe Flash Player Remote Code Execution Vulnerability (CVE-2018-4878)
    1008133* - Cisco WebEx Plugin Magic URL Arbitrary Remote Command Execution Vulnerability
    1004596* - Detected Night Dragon Network Communication
    1005001* - Disallow Packed Executable Download Over HTTP
    1003834* - FFmpeg 'lavf_demux' Animated GIF Processing Remote Denial Of Service Vulnerability
    1005269* - Identified Download Of DLL File Over WebDAV
    1004242* - Media Player Classic '.mpcpl' File Remote Denial Of Service Vulnerability
    1008573 - Microsoft Visio OLE DLL Loading Arbitrary Code Execution Vulnerability Over WebDAV (CVE-2016-3235)
    1008838 - Microsoft Windows ITS Protocol Information Disclosure Vulnerability (CVE-2017-11927)
    1004665* - Multiple Browser "res://mshtml.dll" Remote Code Execution
    1008457* - Ransomware Erebus
    1005395* - Restrict Serialized Java Applet
    1002519* - Storm Botnet Redirect Script Insertion Vulnerability


    Web Client Internet Explorer/Edge
    1004021* - IE DHTML Object Memory Corruption Vulnerability
    1005301* - Identified Suspicious JavaScript Encoded Window Location Object
    1003931* - Microsoft Windows Script Host wshom.ocx ActiveX RegWrite Code Execution
    1004626* - Restrict Cisco Secure Desktop ActiveX Control
    1004743* - Restrict Citrix Access Gateway ActiveX Control
    1005822* - Restrict IBM iNotes UploadControl ActiveX Controls
    1005152* - Restrict Microsoft Windows TabStrip ActiveX Control


    Web Client Mozilla Firefox
    1004371* - Mozilla Firefox Obfuscated URLs Within Iframes Vulnerability


    Web Server Common
    1005013* - Restrict Microsoft .Net Executable File Upload


    Web Server Miscellaneous
    1005221* - Identified Suspicious Novell ZENworks Asset Management rtrlet Component Authentication Bypass
    1004874* - TimThumb Plugin Remote Code Execution Vulnerability


    Web Server Oracle
    1003439* - Oracle Application Server 10g OPMN Service Format String Vulnerability


    Web Service HP SiteScope
    1005837* - HP SiteScope "issueSiebelCmd" SOAP Request Detected


    Integrity Monitoring Rules:

    There are no new or updated Integrity Monitoring Rules in this Security Update.


    Log Inspection Rules:

    There are no new or updated Log Inspection Rules in this Security Update.
  • * indicates a new version of an existing rule

    Deep Packet Inspection Rules:

    Web Client Common
    1008854 - Adobe Flash Player Remote Code Execution Vulnerability (CVE-2018-4878)


    Integrity Monitoring Rules:

    There are no new or updated Integrity Monitoring Rules in this Security Update.


    Log Inspection Rules:

    There are no new or updated Log Inspection Rules in this Security Update.