Rule Update
18-032 (June 12, 2018)
DESCRIPTION
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
DNS Client
1009059* - ISC BIND DNS Denial Of Service Vulnerability (CVE-2017-3145)
1009135 - Microsoft Windows DNSAPI Remote Code Execution Vulnerability (CVE-2018-8225)
Elasticsearch Java API Protocol
1008685* - Elastic Elasticsearch ThrowableObjectInputStream Insecure Deserialization (CVE-2015-5377)
HP Intelligent Management Center (IMC)
1008905* - HPE Intelligent Management Center 'UrlAccessController' Authentication Bypass Vulnerability (CVE-2017-8982)
1008969* - HPE Intelligent Management Center Multiple Expression Language Injection Vulnerability
Microsoft Office
1009138 - Microsoft Excel Remote Code Execution Vulnerability (CVE-2018-8248)
SIP SSL Client
1008554 - Digium Asterisk TLS Certificate Validation Security Bypass Vulnerability (CVE-2015-3008)
Trend Micro Control Manager
1008721* - Trend Micro Control Manager cmdHandlerStatusMonitor SQL Injection Vulnerability (CVE-2017-11385)
Trend Micro OfficeScan
1008191* - Trend Micro Smart Protection Server Authenticated Remote Code Execution Vulnerabilities
VoIP Soft Phones
1008653 - Digium Asterisk Non-SIP URIs Denial Of Service Vulnerability (CVE-2017-14098)
Web Application Common
1009041* - ImageMagick 'ReadDCMImage' Denial Of Service Vulnerability (CVE-2018-6405) - 1
1009038* - ImageMagick 'ReadMATImage' Denial Of Service Vulnerability (CVE-2017-13658) - 1
1008974* - ImageMagick 'ReadMATImage' Denial Of Service Vulnerability (CVE-2017-18029) - 1
1008990* - ImageMagick 'ReadMATImage' Information Disclosure Vulnerability (CVE-2017-13143) - 1
1008992* - ImageMagick 'ReadOneJNGImage' Denial Of Service Vulnerability (CVE-2017-11750) - 1
1008996* - ImageMagick 'ReadPSDImage' Denial Of Service Vulnerability (CVE-2017-13061) - 1
1009090* - ImageMagick ReadOneMNGImage Denial Of Service Vulnerability (CVE-2018-10177) - 1
1008994* - ImageMagick ReadOnePNGImage Memory Leak Vulnerability (CVE-2017-13141) - 1
1008980* - ImageMagick Use-After-Free Vulnerability (CVE-2017-17499) - 1
Web Application PHP Based
1008894* - PHP 'wddx_stack_destroy' Function Use After Free Vulnerability (CVE-2016-7413)
1008914 - PHP WDDX Deserialization Denial Of Service Vulnerability (CVE-2017-11143)
1008913 - PHP WDDX Deserialization Heap Out-Of-Bound Read Vulnerability (CVE-2017-11145)
Web Client Common
1009104 - Adobe Acrobat Reader Out Of Bounds Read Vulnerability (CVE-2017-16397)
1009102 - Adobe Acrobat Reader Out Of Bounds Read Vulnerability (CVE-2017-16404)
1009146 - Adobe Flash Player Multiple Security Vulnerabilities (APSB18-19)
1008829* - Foxit Reader Multiple Information Disclosure Vulnerabilities
1009014* - Microsoft Windows Graphics Multiple Security Vulnerabilities (Apr-2018)
1009140 - Microsoft Windows Media Foundation Memory Corruption Vulnerability (CVE-2018-8251)
1009131 - Microsoft Windows Multiple Elevation Of Privilege Vulnerabilities (June-2018)
1009134 - Microsoft Windows Remote Code Execution Vulnerability (CVE-2018-8210)
1009044 - Multiple Web Browser WebRTC Private IP Leakage To WebPage Vulnerability (CVE-2018-6849)
Web Client Internet Explorer/Edge
1009132 - Microsoft Edge Memory Corruption Vulnerability (CVE-2018-8110)
1009133 - Microsoft Edge Memory Corruption Vulnerability (CVE-2018-8111)
1009137 - Microsoft Edge Memory Corruption Vulnerability (CVE-2018-8236)
1009136 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-8229)
1009130 - Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2018-0978)
1009139 - Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2018-8249)
1009141 - Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2018-8267)
Web Server Adobe ColdFusion
1008879* - Adobe Coldfusion BlazeDS Java Object Deserialization Remote Code Execution Vulnerability (CVE-2017-3066)
Web Server Apache
1009087* - Apache httpd FilesMatch Directive Security Restriction Bypass Vulnerability (CVE-2017-15715)
Integrity Monitoring Rules:
1008720* - Users and Groups - Create and Delete Activity
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
Deep Packet Inspection Rules:
DNS Client
1009059* - ISC BIND DNS Denial Of Service Vulnerability (CVE-2017-3145)
1009135 - Microsoft Windows DNSAPI Remote Code Execution Vulnerability (CVE-2018-8225)
Elasticsearch Java API Protocol
1008685* - Elastic Elasticsearch ThrowableObjectInputStream Insecure Deserialization (CVE-2015-5377)
HP Intelligent Management Center (IMC)
1008905* - HPE Intelligent Management Center 'UrlAccessController' Authentication Bypass Vulnerability (CVE-2017-8982)
1008969* - HPE Intelligent Management Center Multiple Expression Language Injection Vulnerability
Microsoft Office
1009138 - Microsoft Excel Remote Code Execution Vulnerability (CVE-2018-8248)
SIP SSL Client
1008554 - Digium Asterisk TLS Certificate Validation Security Bypass Vulnerability (CVE-2015-3008)
Trend Micro Control Manager
1008721* - Trend Micro Control Manager cmdHandlerStatusMonitor SQL Injection Vulnerability (CVE-2017-11385)
Trend Micro OfficeScan
1008191* - Trend Micro Smart Protection Server Authenticated Remote Code Execution Vulnerabilities
VoIP Soft Phones
1008653 - Digium Asterisk Non-SIP URIs Denial Of Service Vulnerability (CVE-2017-14098)
Web Application Common
1009041* - ImageMagick 'ReadDCMImage' Denial Of Service Vulnerability (CVE-2018-6405) - 1
1009038* - ImageMagick 'ReadMATImage' Denial Of Service Vulnerability (CVE-2017-13658) - 1
1008974* - ImageMagick 'ReadMATImage' Denial Of Service Vulnerability (CVE-2017-18029) - 1
1008990* - ImageMagick 'ReadMATImage' Information Disclosure Vulnerability (CVE-2017-13143) - 1
1008992* - ImageMagick 'ReadOneJNGImage' Denial Of Service Vulnerability (CVE-2017-11750) - 1
1008996* - ImageMagick 'ReadPSDImage' Denial Of Service Vulnerability (CVE-2017-13061) - 1
1009090* - ImageMagick ReadOneMNGImage Denial Of Service Vulnerability (CVE-2018-10177) - 1
1008994* - ImageMagick ReadOnePNGImage Memory Leak Vulnerability (CVE-2017-13141) - 1
1008980* - ImageMagick Use-After-Free Vulnerability (CVE-2017-17499) - 1
Web Application PHP Based
1008894* - PHP 'wddx_stack_destroy' Function Use After Free Vulnerability (CVE-2016-7413)
1008914 - PHP WDDX Deserialization Denial Of Service Vulnerability (CVE-2017-11143)
1008913 - PHP WDDX Deserialization Heap Out-Of-Bound Read Vulnerability (CVE-2017-11145)
Web Client Common
1009104 - Adobe Acrobat Reader Out Of Bounds Read Vulnerability (CVE-2017-16397)
1009102 - Adobe Acrobat Reader Out Of Bounds Read Vulnerability (CVE-2017-16404)
1009146 - Adobe Flash Player Multiple Security Vulnerabilities (APSB18-19)
1008829* - Foxit Reader Multiple Information Disclosure Vulnerabilities
1009014* - Microsoft Windows Graphics Multiple Security Vulnerabilities (Apr-2018)
1009140 - Microsoft Windows Media Foundation Memory Corruption Vulnerability (CVE-2018-8251)
1009131 - Microsoft Windows Multiple Elevation Of Privilege Vulnerabilities (June-2018)
1009134 - Microsoft Windows Remote Code Execution Vulnerability (CVE-2018-8210)
1009044 - Multiple Web Browser WebRTC Private IP Leakage To WebPage Vulnerability (CVE-2018-6849)
Web Client Internet Explorer/Edge
1009132 - Microsoft Edge Memory Corruption Vulnerability (CVE-2018-8110)
1009133 - Microsoft Edge Memory Corruption Vulnerability (CVE-2018-8111)
1009137 - Microsoft Edge Memory Corruption Vulnerability (CVE-2018-8236)
1009136 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-8229)
1009130 - Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2018-0978)
1009139 - Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2018-8249)
1009141 - Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2018-8267)
Web Server Adobe ColdFusion
1008879* - Adobe Coldfusion BlazeDS Java Object Deserialization Remote Code Execution Vulnerability (CVE-2017-3066)
Web Server Apache
1009087* - Apache httpd FilesMatch Directive Security Restriction Bypass Vulnerability (CVE-2017-15715)
Integrity Monitoring Rules:
1008720* - Users and Groups - Create and Delete Activity
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
Featured Stories
When AI Becomes a Zero-Day Machine: What Public Sector Organizations Need to KnowClaude Mythos Preview shows how AI can rapidly discover and weaponize zero-day vulnerabilities—transforming once human-scale threats into machine-speed attacks. As these capabilities spread, public sector organizations must rely on trusted, proactive defenders like TrendAI™ ZDI to stay ahead of an AI-driven threat landscape.Read more
Hunt Them All: An AI-Powered Vulnerability Sweep of 19,000 MCP ServersIn this research, we analyzed over 19,000 open-source MCP server repositories to uncover how much AI-generated code they contain and how many harbor exploitable vulnerabilities.Read more
Update on Exposed MCP Servers: The Threat Widens to the CloudExposed Model Context Protocol (MCP) servers have become powerful vectors for cloud attacks, enabling threat actors to not only access sensitive data but also take control of the cloud services themselves.Read more
Old Vulnerabilities, New AI Era, Amplified Risk: How Outdated Flaws Continue to Fuel the N-Day Exploit MarketEven as AI adoption accelerates, old exploits remain overlooked weaknesses. Underground trends show a renewed demand for exploits, with cybercriminals relying on aging but still effective vulnerabilities. We examine this blind spot and why long-standing issues need to be addressed.Read more