|
|
The FortiGuard Global Threat Research Team has released new security content to cover multiple vulnerabilities. The FortiGuard Team has observed 85 active exploitations of these vulnerabilities to date.
For more information, visit the FortiGuard Center at www.fortiguardcenter.com.
Fortinet provides coverage for the vulnerabilities described below as of the 3.136 IPS Definitions database update. A brief description of each vulnerability is provided as follows, in order of severity.
Critical ( 11 )
| Vulnerability | Release Date | IPS Definition DB Version |
|---|---|---|
| Adobe.Acrobat.BMP.Colors.Parsing.Memory.Corruption | Jan 11, 2012 | 3.133 |
| Adobe.Acrobat.BMP.Parsing.Memory.Corruption | Jan 11, 2012 | 3.133 |
| Adobe.Acrobat.JPEG.Decoding.Memory.Corruption | Jan 11, 2012 | 3.133 |
| Adobe.Acrobat.JavaScript.SubmitForm.Memory.Corruption | Jan 11, 2012 | 3.133 |
| InduSoft.Web.Studio.Insecure.Operations.Remote.Code.Execution | Jan 10, 2012 | 3.132 |
| Kiwi.CatTools.TFTP.Directory.Traversal | Jan 18, 2012 | 3.136 |
| Libtelnet.Key.Remote.Buffer.Overflow | Jan 18, 2012 | 3.136 |
| MS.DirectShow.L21.Remote.Code.Execution | Jan 11, 2012 | 3.133 |
| MS.IE.DHTML.Script.Function.Memory.Corruption | Jan 10, 2012 | 3.132 |
| MS.Publisher.Pubconv.dll.Pointer.Overwrite.Memory.Corruption | Jan 18, 2012 | 3.136 |
| MS.Windows.Media.MIDI.Remote.Code.Execution | Jan 11, 2012 | 3.133 |
High ( 19 )
Medium ( 3 )
| Vulnerability | Release Date | IPS Definition DB Version |
|---|---|---|
| MS.ASP.NET.Form.Authentication.Insecure.Redirect | Jan 10, 2012 | 3.132 |
| Rsyslog.Stack.Buffer.Overflow | Jan 18, 2012 | 3.136 |
| Sun.Solaris.DHCP.Malformed.BOOTP.Packet.DoS | Jan 10, 2012 | 3.132 |
Low ( 1 )
| Vulnerability | Release Date | IPS Definition DB Version |
|---|---|---|
| FTP.Bounce.Port.Scanner | Jan 18, 2012 | 3.136 |
Top of Section
The FortiGuard Threat Research team updates security content as new vectors of exploitation are discovered. The table below details the security content enhanced with this release.
Critical ( 48 )
| Vulnerability | Revision Notes |
|---|---|
| Adobe.Acrobat.GetAnnots.Code.Execution | Detection Enhanced Default_action updated to 'drop' Detection Enhanced |
| Adobe.CoolType.SING.Table.uniqueName.Buffer.Overflow | Detection Enhanced Detection Enhanced |
| Adobe.Flash.Player.Authplay.DLL.SWF.Handling.Code.Execution | Detection Enhanced Detection Enhanced |
| Adobe.Flash.Player.Authplay.Dll.SWF.File.Handle.Code.Execution | Default_action updated to 'drop' |
| Adobe.Flash.Player.Authplay.Remote.Code.Execution | Detection Enhanced |
| Adobe.Flash.Remote.Memory.Corruption | Default_action updated to 'drop' |
| Adobe.Illustrator.Remote.Buffer.Overflow | Detection Enhanced Default_action updated to 'pass' Detection Enhanced |
| Adobe.Reader.Javascript.newplayer.Method.Code.Execution | Detection Enhanced Default_action updated to 'drop' Detection Enhanced |
| Adobe.Reader.Spell.CustomDictionaryOpen.Remote.Code.Execution | Default_action updated to 'drop' |
| Adobe.U3D.CLOD.Mesh.Declaration.Array.Buffer.Overflow | Default_action updated to 'pass' Detection Enhanced |
| BEA.Weblogic.Double.Dot.Buffer.Overflow | Detection Enhanced |
| Bredolab.Botnet.CC | Previous name: "Bredolab.Botnet" Detection Enhanced |
| FreeDownloadManager.Torrent.Multitags.Buffer.Overflow | Detection Enhanced Default_action updated to 'pass' |
| Gumblar.Botnet.CC | Previous name: "Gumblar.Botnet" |
| HP.OpenView.Storage.Data.Protector.Stack.Buffer.Overflow | Default_action updated to 'drop' |
| HP.Power.Manager.FormExportDataLogs.Buffer.Overflow | Default_action updated to 'drop' |
| HT.MP3Player.HT3.Buffer.Overflow | Detection Enhanced |
| InduSoft.Web.Studio.Insecure.Operations.Remote.Code.Execution | Detection Enhanced |
| LibPNG.tRNS.BufferOverflow | Default_action updated to 'drop' |
| MS.Excel.Obj.Record.Code.Execution | Default_action updated to 'drop' Detection Enhanced Detection Enhanced |
| MS.Exchange.Server.iCal.Request.DoS | Default_action updated to 'drop' |
| MS.GDI.WMF.META.DIB.Heap.Overflow | Detection Enhanced Default_action updated to 'drop' Detection Enhanced |
| MS.GDIPlus.EMFPlusPoint.Integer.Overflow | Default_action updated to 'drop' Detection Enhanced Detection Enhanced |
| MS.Host.Integration.Server.RPC.Service.Code.Execution | Detection Enhanced |
| MS.IE.DHTML.Script.Function.Memory.Corruption | Detection Enhanced |
| MS.IE.Vector.Markup.Language.Remote.Code.Execution | Detection Enhanced Default_action updated to 'drop' Detection Enhanced |
| MS.License.Logging.Server.RPC.Code.Execution | Default_action updated to 'drop' Detection Enhanced Detection Enhanced |
| MS.OpenType.Font.Index.Code.Execution | Detection Enhanced Default_action updated to 'drop' Detection Enhanced |
| MS.Paint.JPEG.Integer.Overflow | Default_action updated to 'drop' |
| MS.SMB.Client.Transaction.Code.Execution | Detection Enhanced Default_action updated to 'drop' Detection Enhanced |
| MS.VS.WMI.Object.Broker.ActiveX.Code.Execution | Detection Enhanced Default_action updated to 'drop' Detection Enhanced Detection Enhanced Default_action updated to 'pass' |
| MS.Visio.Compressed.Document.Packaged.Object.Code.Execution | Detection Enhanced Default_action updated to 'pass' |
| MS.Windows.Media.MIDI.Remote.Code.Execution | Detection Enhanced |
| MS.Windows.Message.Queuing.RPC.QMCOMM.Code.Execution | Default_action updated to 'drop' |
| MS.Windows.OLE.Remote.Code.Execution | Detection Enhanced Default_action updated to 'drop' Detection Enhanced |
| MS.Windows.WINS.Memory.Corruption | Default_action updated to 'drop' |
| MS.Word.Document.Stream.Handling.Code.Execution | Default_action updated to 'drop' |
| Novell.GroupWise.iCal.RRULE.Time.Conversion.Invalid.Array.Index | Default_action updated to 'drop' |
| Oracle.DBMS.Cdc.Publish.SQL.Injection | Detection Enhanced Default_action updated to 'drop' Detection Enhanced |
| Oracle.Secure.Backup.EXEC.QR.URI.Command.Injection | Default_action updated to 'drop' |
| PeaZIP.Archived.FileName.Command.Injection | Detection Enhanced Default_action updated to 'pass' Detection Enhanced |
| Sendmail.Header.Buffer.Overflow | Detection Enhanced |
| Sun.Java.System.Web.Server.WEBDAV.Stack.Buffer.Overflow | Detection Enhanced Default_action updated to 'drop' Detection Enhanced |
| Sun.Java.Web.Proxy.sockd.Remote.Buffer.Overflow | Detection Enhanced Default_action updated to 'drop' Detection Enhanced |
| Torpig.Mebroot.Botnet.CC | Previous name: "Torpig.Mebroot.Botnet" |
| TugZip.File.Parsing.Buffer.Overflow | Detection Enhanced |
| UltraISO.CCD.Buffer.Overflow | Detection Enhanced |
| Waledac.Botnet.CC | Previous name: "Waledac.Botnet" Detection Enhanced |
High ( 82 )
Medium ( 19 )
| Vulnerability | Revision Notes |
|---|---|
| Adobe.Acrobat.Reader.Shell.Metacharacter.Code.Execution | Default_action updated to 'drop' |
| AnnoncesV.Annonce.PHP.Remote.File.Inclusion | Detection Enhanced Detection Enhanced |
| Graphiks.GrapAgenda.Index.php.Remote.File.Inclusion | Detection Enhanced Detection Enhanced |
| HTTP.Response.Splitting.Information.Disclosure | Detection Enhanced Default_action updated to 'pass' |
| HTTPS.CBC.Mode.Information.Disclosure | Detection Enhanced Severity updated to 'medium' Detection Enhanced |
| IMAP.APPEND.Command.Buffer.Overflow | Severity updated to 'medium' |
| LOIC.IRC.Botnet.CC | Previous name: "LOIC.IRC" |
| MS.ASP.NET.Form.Authentication.Insecure.Redirect | Detection Enhanced Severity updated to 'medium' |
| MS.CapiCom.Utilities.ActiveX.GetRandom.Integer.Overflow.DoS | Detection Enhanced Default_action updated to 'drop' Detection Enhanced |
| MS.Malware.Protection.Engine.File.Processing.DoS | Default_action updated to 'drop' |
| MS.Windows.Sapi.Dll.ActiveX.Control.Access | Default_action updated to 'drop' |
| Oracle.Database.PITRIG_DROPMETADATA.Procedure.Buffer.Overflow | Detection Enhanced Default_action updated to 'drop' Detection Enhanced |
| Oracle.Database.SYS.LT.FINDRICSET.SQL.Injection | Default_action updated to 'drop' Detection Enhanced Detection Enhanced |
| Oracle.GlassFish.Administration.Console.Authentication.Bypass | Detection Enhanced Default_action updated to 'pass' |
| Oracle.SYS.LT.ROLLBACKWORKSPACE.SQL.Injection | Detection Enhanced Default_action updated to 'drop' Detection Enhanced |
| Oracle.Spatial.Application.Priviledge.Escalation | Detection Enhanced Default_action updated to 'drop' Detection Enhanced |
| PDF.With.Launch.Action | Default_action updated to 'pass' Detection Enhanced Detection Enhanced |
| SIP.Phone.Proxy.Authentication.Required.Credential.Disclosure | Default_action updated to 'drop' |
| Sun.Solaris.DHCP.Malformed.BOOTP.Packet.DoS | Detection Enhanced |
Low ( 56 )
| Vulnerability | Revision Notes |
|---|---|
| ACal.Arbitrary.Command.Execution | Detection Enhanced Severity updated to 'low' |
| Aardvark.Topsites.PHP.Arbitrary.Command.Execution | |
| Agile.Joomla.Components.Parameter.Local.File.Inclusion | Detection Enhanced Severity updated to 'low' Detection Enhanced |
| Apple.Quicktime.Multiple.Vuln | Severity updated to 'low' Detection Enhanced |
| Asterisk.Skinny.Channel.Driver.Remote.DoS | Default_action updated to 'drop' |
| Bind.InverseQuery.Overflow | Detection Enhanced Severity updated to 'low' Detection Enhanced |
| Dagger.Cal.Func.PHP.File.Inclusion | Detection Enhanced Severity updated to 'low' |
| FrontAccounting.Config.PHP.File.Inclusion | Severity updated to 'low' |
| Galleria.galleria.html.php.File.Inclusion | Detection Enhanced Severity updated to 'low' |
| Horde.Eval.Poor.Input.Validation | Severity updated to 'low' |
| ISC.DHCPD.Hostname.Buffer.Overflow | Detection Enhanced Severity updated to 'low' Detection Enhanced |
| Idan.Sofer.phphtml.PHP.File.Inclusion | Detection Enhanced Severity updated to 'low' |
| MPlayer.RTSP.Line.Response.Buffer.Overflow | Severity updated to 'low' Detection Enhanced Detection Enhanced |
| MS.DirectX.DirectShow.Buffer.Overflow | Severity updated to 'low' |
| MS.IE.DHTML.Method.Heap.Memory.Corruption | Severity updated to 'low' Detection Enhanced |
| MS.IE.HTML.Same.Origin.Policy.Violation | Detection Enhanced Severity updated to 'low' Detection Enhanced |
| MS.IE.HTTPS.ProxyAuthentication.Basic | Detection Enhanced Severity updated to 'low' |
| MS.IIS.IndexServer.Disclosure | Default_action updated to 'drop' |
| MS.InternetExplorer.ContentEncoding.BufferOverflow | Detection Enhanced Severity updated to 'low' |
| MS.Office.Document.Handling.Code.Execution | Severity updated to 'low' Detection Enhanced Detection Enhanced |
| MS.RDS.Dataspace.ActiveX.Access | Severity updated to 'low' |
| MS.Speech.Engines.ActiveX.Buffer.Overflow | Detection Enhanced Severity updated to 'low' |
| MS.Windows.Media.Encoder.WMEX.DLL.Buffer.Overflow | Detection Enhanced Severity updated to 'low' |
| MS.Windows.Media.Player.ActiveX.Insecure.Method.Access | Detection Enhanced Severity updated to 'low' Detection Enhanced |
| MS.Windows.WinHlp.Buffer.Overflow | Detection Enhanced Severity updated to 'low' Detection Enhanced |
| MS.Windows.XP.HCP.URI.Handler.Arbitrary.Command.Execution | Severity updated to 'low' |
| Mozilla.Firefox.Arbitrary.HTTP.Request.Injection | Severity updated to 'low' |
| Multiple.Mozilla.Products.IFRAME.JavaScript.Execution | Detection Enhanced Severity updated to 'low' |
| NcasterCMS.Archive.PHP.File.Inclusion | Detection Enhanced Severity updated to 'low' |
| Oracle.9i.Application.Server.Web.Cache.DoS | Default_action updated to 'drop' |
| Oracle.Java.docBase.Parameter.Overflow | Severity updated to 'low' Detection Enhanced |
| PHP.MyGuestbook.Form.inc.php3.Remote.File.Include | Detection Enhanced Severity updated to 'low' |
| PHP.PPA.PpaRootPath.Remote.File.Include | Detection Enhanced Severity updated to 'low' |
| PHP.iPhotoAlbum.Remote.File.Include | Severity updated to 'low' Detection Enhanced Detection Enhanced |
| PHPNews.Change_Action.PHP.File.Inclusion | Severity updated to 'low' Detection Enhanced |
| Photokorn.File.Inclusion | Detection Enhanced Severity updated to 'low' |
| Php.Blue.Dragon.Activecontent.PHP.File.Inclusion | Severity updated to 'low' Detection Enhanced |
| PhpConcept.Library.Parameter.g_pcltar_lib_dir.File.Inclusion | Severity updated to 'low' Detection Enhanced |
| RaXnet.Cacti.ConfigSettings.PHP.Remote.File.Include | Severity updated to 'low' Detection Enhanced |
| RealNetworks.RealPlayer.rmoc3260.ActiveX.Code.Execution | Detection Enhanced Severity updated to 'low' Detection Enhanced |
| RealPlayer.SWF.Parsing.Heap.Overflow | Severity updated to 'low' |
| ReloadCMS.UserAgent.HTML.Injection | Detection Enhanced Severity updated to 'low' |
| Sina.DLoader.DownloadAndInstall.Method.ActiveX.Access | Detection Enhanced Severity updated to 'low' |
| Squito.Gallery.Photolist.inc.php.File.Include | Detection Enhanced Severity updated to 'low' Detection Enhanced |
| Storm.Krackin.Botnet.CC | Previous name: "Trojan.Storm.Worm.Krackin.Detection" Severity updated to 'low' |
| Sun.Java.Applet2ClassLoader.Code.Execution | Detection Enhanced Severity updated to 'low' Detection Enhanced |
| TCP.Window.Size.Zero.DoS | Detection Enhanced |
| UUSee.UUUpgrade.Update.Method.ActiveX.Control.Access | Severity updated to 'low' Detection Enhanced |
| WANewsletter.Waroot.Parameter.File.Inclusion | Severity updated to 'low' |
| WMNews.Multiple.Remote.File.Include | Detection Enhanced Severity updated to 'low' |
| WTools.Common.PHP.Remote.File.Include | Detection Enhanced Severity updated to 'low' Detection Enhanced |
| WTools.Common.PHP.Remote.File.Inclusion | Previous name: "WTools.Common.PHP.Remote.File.Include" |
| WebProvence.Spaw.control.class.PHP.Remote.File.Inclusion | Detection Enhanced Severity updated to 'low' |
| Xoops.Horoscope.Module.Footer.PHP.File.Inclusion | Severity updated to 'low' |
| Xoops.Multiple.Modules.SpawControl.Class.PHP.File.Inclusion | Severity updated to 'low' |
| Yahoo.Messenger.Webcam.Upload.Viewer.ActiveX.Buffer.Overflow | Severity updated to 'low' Detection Enhanced |
Info ( 1 )
| Vulnerability | Revision Notes |
|---|---|
| DNS.Zone.Transfer | Detection Enhanced |
Top of Section
The FortiGuard Threat Research team uses globally distributed probes to monitor exploit activity. Vulnerabilities can be classified as active and given a magnitude level. The magnitude level is the rate of activity across the probes. The value of the magnitude is set to low, medium or high.
The table below lists the vulnerabilities discussed in this bulletin (specifically new and enhanced detection) and their corresponding exploit activity magnitude. The data below is as of this writing.
Critical ( 24 of 41 )
High ( 25 of 61 )
Medium ( 7 of 14 )
Low ( 28 of 41 )
Info ( 1 of 1 )
| Vulnerability | Active Exploitaion Observed | Magnitude |
|---|---|---|
| DNS.Zone.Transfer | Yes | Medium |
Top of Section