Update Details

Update #3390 (06/08/2021)

10 new signatures:

CRITICAL	APP:MISC:HP-LODRUNR-MGNTPRC-RCE	APP: HP Mercury LoadRunner Agent magentproc.exe Remote Command Execution
MEDIUM	HTTP:CTS:ROCKWELL-FACTRYTALK-CE	HTTP: Rockwell Factorytalk Remote Code Execution
HIGH	HTTP:CTS:GOOGLE-PRXYSTYLSHET-CE	HTTP: Google proxystylesheet Arbitrary Command Execution
HIGH	HTTP:STC:DL:CVE-2021-31952-EOP	HTTP: Windows Kernel-Mode Driver CVE-2021-31952 Elevation of Privilege
HIGH	APP:MISC:TP-LINK-ARCHER-A7-CE	APP: TP-Link Archer A7/C7 Unauthenticated LAN Remote Code Execution
HIGH	HTTP:STC:IE:CVE-2021-31959-MC	HTTP: Microsoft Internet Explorer Scripting Engine CVE-2021-31959 Memory Corruption
MEDIUM	HTTP:STC:ADOBE:DC-ANNOTS-OOB	HTTP: Adobe Acrobat Reader DC Annots File ID Out of Bounds Read
HIGH	HTTP:STC:MULTI-VENDOR-ZIP-SLIP	HTTP: Multiple Vendors Directory Traversal
MEDIUM	HTTP:STC:EVINCE-CBT-CMD-INJ	HTTP: GNOME Evince CBT Command Injection
HIGH	HTTP:CTS:WP-MOBILE-DTCTR-AFU	HTTP: WordPress WP Mobile Detector Shell Upload

3 updated signatures:

HIGH	HTTP:CTS:CVE-2021-31166-RCE	HTTP: Microsoft IIS Protocol Stack CVE-2021-31166 Remote Code Execution
HIGH	APP:MISC:NETGEAR-TELNETENABLE	APP: NETGEAR TelnetEnable Attempt Detected
HIGH	HTTP:CISCO:HYPERFLEX-HX-RCE	HTTP: Cisco HyperFlex HX Remote Command Execution

Details of the signatures included within this bulletin:

HTTP:CTS:CVE-2021-31166-RCE - HTTP: Microsoft IIS Protocol Stack CVE-2021-31166 Remote Code Execution

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against HTTP Protocol Stack. A successful attack can lead to arbitrary code execution.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, idp-5.0.0, vsrx-17.4, srx-branch-17.4, srx-17.4, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, isg-3.5.141818, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, isg-3.0.0, idp-5.1.110170603, vsrx-15.1

References:

cve: CVE-2021-31166

Affected Products:

Microsoft windows_server_2016 2004
Microsoft windows_10 20h2
Microsoft windows_10 2004
Microsoft windows_server_2016 20h2

APP:MISC:HP-LODRUNR-MGNTPRC-RCE - APP: HP Mercury LoadRunner Agent magentproc.exe Remote Command Execution

Severity: CRITICAL

Description:

This signature detects attempts to exploit a known vulnerability against HP Mercury LoadRunner. A successful attack can lead to arbitrary code execution.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, srx-17.4, idp-5.1.110170603, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, isg-3.0.0, isg-3.1.134269, vsrx-15.1

References:

cve: CVE-2010-1549

Affected Products:

Hp loadrunner 7.6
Hp loadrunner 8.0
Hp loadrunner 7.5
Hp loadrunner 9.0
Hp loadrunner 7.02
Hp loadrunner 7.0
Hp loadrunner 7.51
Hp loadrunner 8.12
Hp loadrunner 7.8
Hp loadrunner 8.13
Hp loadrunner up to 9.10
Hp performance_center up to 9.0
Hp loadrunner 8.14

HTTP:CTS:ROCKWELL-FACTRYTALK-CE - HTTP: Rockwell Factorytalk Remote Code Execution

Severity: MEDIUM

Description:

This signature detects attempts to exploit a known vulnerability against Rockwell factorytalk. A successful attack can lead to sensitive information disclosure.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, srx-17.4, idp-5.1.110170603, vsrx-15.1

References:

cve: CVE-2020-12027

Affected Products:

Rockwellautomation factorytalk_view

HTTP:CTS:GOOGLE-PRXYSTYLSHET-CE - HTTP: Google proxystylesheet Arbitrary Command Execution

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Google proxystylesheet. A successful attack can lead to arbitrary code execution.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, srx-17.4, idp-5.1.110170603, vsrx-15.1

References:

bugtraq: 15509
cve: CVE-2005-3757

Affected Products:

Google search_appliance
Google mini_search_appliance

HTTP:STC:DL:CVE-2021-31952-EOP - HTTP: Windows Kernel-Mode Driver CVE-2021-31952 Elevation of Privilege

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Windows Kernel-Mode Driver. A successful attack can lead to elevation of privilege and arbitrary code execution.

Supported On:

References:

cve: CVE-2021-31952

Affected Products:

Microsoft windows_10 20h2
Microsoft windows_server_2016 2004
Microsoft windows_10 2004
Microsoft windows_server_2016 20h2
Microsoft windows_10 21h1
Microsoft windows_server_2019
Microsoft windows_10 1909

APP:MISC:TP-LINK-ARCHER-A7-CE - APP: TP-Link Archer A7/C7 Unauthenticated LAN Remote Code Execution

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against TP-Link Archer A7/C7. A successful attack can lead to remote code execution.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, srx-17.4, idp-5.1.110170603, vsrx-15.1

References:

HTTP:STC:IE:CVE-2021-31959-MC - HTTP: Microsoft Internet Explorer Scripting Engine CVE-2021-31959 Memory Corruption

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Microsoft Internet Explorer Scripting Engine. A successful attack can lead to arbitrary code execution.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, srx-17.4, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, idp-5.1.110170603, vsrx-15.1

References:

cve: CVE-2021-31959

Affected Products:

Microsoft windows_10 20h2
Microsoft windows_10 1809
Microsoft windows_server_2008 r2
Microsoft windows_server_2016
Microsoft windows_rt_8.1
Microsoft windows_10 2004
Microsoft windows_server_2012
Microsoft windows_10
Microsoft windows_10 21h1
Microsoft windows_8.1
Microsoft windows_server_2019
Microsoft windows_7
Microsoft windows_10 1909
Microsoft windows_10 1607
Microsoft windows_server_2012 r2

HTTP:STC:ADOBE:DC-ANNOTS-OOB - HTTP: Adobe Acrobat Reader DC Annots File ID Out of Bounds Read

Severity: MEDIUM

Description:

This signature detects attempts to exploit a known vulnerability against Adobe Acrobat and Acrobat Reader. A successful attack can lead to arbitrary code execution.

Supported On:

idp-5.1.110161014, idp-4.1.0, mx-16.1, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, srx-17.4, idp-5.1.110170603, vsrx3bsd-18.2, srx-18.2, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, srx-branch-19.1, vsrx-19.2, srx-19.2, srx-branch-19.2, vsrx3bsd-19.2, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, j-series-9.5, mx-11.4, srx-12.1, srx-branch-12.1, vsrx-12.1, vsrx-15.1

References:

cve: CVE-2021-21042

HTTP:CISCO:HYPERFLEX-HX-RCE - HTTP: Cisco HyperFlex HX Remote Command Execution

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Cisco. A successful attack can lead to arbitrary code execution.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, srx-17.4, idp-5.1.110170603, vsrx-15.1

References:

APP:MISC:NETGEAR-TELNETENABLE - APP: NETGEAR TelnetEnable Attempt Detected

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against NETGEAR. A successful exploit can lead to remote code execution.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, srx-17.4, idp-5.1.110170603, vsrx-15.1

References:

url: https://wiki.openwrt.org/toh/netgear/telnet.console

HTTP:STC:MULTI-VENDOR-ZIP-SLIP - HTTP: Multiple Vendors Directory Traversal

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against multiple vendors. A successful attack can lead to directory traversal and arbitrary code execution.

Supported On:

HTTP:STC:EVINCE-CBT-CMD-INJ - HTTP: GNOME Evince CBT Command Injection

Severity: MEDIUM

Description:

This signature detects attempts to exploit a known vulnerability against GNOME Evince. A successful attack can lead to command injection and arbitrary code execution.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, idp-5.0.0, vsrx-17.4, srx-branch-17.4, isg-3.0.0, idp-5.1.110170603, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, isg-3.5.141818, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, srx-17.4, isg-3.1.134269, vsrx-15.1

References:

cve: CVE-2017-1000083

Affected Products:

Redhat enterprise_linux_workstation 7.0
Debian debian_linux 9.0
Redhat enterprise_linux_server 7.4
Debian debian_linux 8.0
Redhat enterprise_linux_server_eus 7.6
Redhat enterprise_linux_server_eus 7.4
Redhat enterprise_linux_server_tus 7.6
Redhat enterprise_linux_server 7.6
Redhat enterprise_linux_server_eus 7.5
Redhat enterprise_linux_server 7.0
Redhat enterprise_linux_server_aus 7.6
Redhat enterprise_linux_server_tus 7.4
Redhat enterprise_linux_desktop 7.0
Gnome evince 3.24.0
Redhat enterprise_linux_server 7.5
Redhat enterprise_linux_server_aus 7.4

HTTP:CTS:WP-MOBILE-DTCTR-AFU - HTTP: WordPress WP Mobile Detector Shell Upload

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against WordPress Mobile Detector. A successful attack can lead to remote file inclusion.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, srx-17.4, idp-5.1.110170603, vsrx-15.1

References:

url: https://www.snort.org/rule_docs/1-39350