21-005 (February 2, 2021)

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

DNS Client
1010744 - DNS Request To Ngrok Domain Detected
1010740 - DNSmasq DNSSEC Heap Based Buffer Overflow Vulnerability (CVE-2020-25681)


DNS Server
1004747* - DNS Invalid Compression Denial Of Service


Directory Server LDAP
1010667* - Microsoft Windows Active Directory IntegratedDNS Remote Code Execution Vulnerability (CVE-2020-0761)
1010321* - OpenLDAP slapd Nested Filter Stack Overflow Vulnerability (CVE-2020-12243)


FTP Server IIS
1004553* - Microsoft IIS FTPSVC Unspecified Remote Denial Of Service


Java RMI
1009390* - Apache Commons FileUpload DiskFileItem File Manipulation Remote Code Execution Vulnerability (CVE-2016-1000031)


Memcached
1010745 - Memcached 'process_bin_sasl_auth' Integer Overflow Vulnerability (CVE-2016-8706)


Suspicious Client Application Activity
1010741* - Identified HTTP Backdoor Python FreakOut A Runtime Detection


Unix Samba
1008847* - Samba Information Disclosure Vulnerability (CVE-2017-15275)


Web Application Common
1010750 - Zend Framework Deserialization Remote Code Execution Vulnerability (CVE-2021-3007)


Web Client Common
1008753 - GNU Wget 'fd_read_body' Heap Buffer Overflow Vulnerability (CVE-2017-13090)
1008750 - GNU Wget 'skip_short_body' Stack Buffer Overflow Vulnerability (CVE-2017-13089)


Web Server Apache
1010461* - Apache Struts2 Remote Code Execution Vulnerability (CVE-2019-0230)


Web Server Common
1010725 - Pi-Hole Remote Command Execution Vulnerability (CVE-2020-8816)
1010755 - SAP Solution Manager Remote Code Execution Vulnerability (CVE-2020-6207)


Web Server Miscellaneous
1010753 - Atlassian Jira Server-Side Request Forgery Vulnerability (CVE-2019-8451)


Web Server Oracle
1010752 - Oracle Coherence Server T3 Protocol Insecure Deserialization Vulnerability (CVE-2020-14756)
1010739* - Oracle WebLogic Console JNDI Injection Vulnerability (CVE-2021-2109)


Web Server SharePoint
1010738 - Restrict Attempt To Enumerate Microsoft SharePoint For User Accounts (ATT&CK T1087)


Integrity Monitoring Rules:

1010055* - AntiVirus - Trend Micro ApexOne Server
1003744* - AntiVirus - Trend Micro OfficeScan Server


Log Inspection Rules:

There are no new or updated Log Inspection Rules in this Security Update.