TippingPoint Threat Intelligence and Zero-Day Coverage – Week of December 25, 2017

Last Sunday, my day could be best described by the lyrics of Sammy Hagar’s song “I Can’t Drive 55.” I was issued a ticket for an alleged speeding infraction. I usually drive about 10 mph over the speed limit, but my “alleged” lead foot got the best of me and so did the Texas Highway Patrol. C’est la vie…

No one will ever get a ticket for their network performing at top speeds, and we’ll make sure that it’s secure at the same time. We recently launched our new TippingPoint TX Series, with our 8200TX delivering an unprecedented 40 Gbps of inline inspection throughput in just a single rack unit (1U) form factor. Need a little more oomph? You can stack three 8200TX devices to get up to 120 Gbps. Our 8400TX comes in a 2U form factor for those of you who need more port density. And, the 8400TX is recommended by NSS Labs in their 2017 NGIPS Group Test, with an overall security effectiveness rating of 99.6% and network latency tested at under 10 microseconds. You can learn more about the TippingPoint TX Series and all the great new features here.

One last thing! On a personal note, I’d like to thank all of you who take the time to read my little blog. I wish you all a happy and prosperous 2018!

3.2.0 Digital Vaccine Deployment

Customers with TippingPoint models 10/110/330 that are running TOS v3.6.6 or earlier must upgrade to TOS v3.6.7 at the earliest opportunity. Failure to upgrade will result in the inability to update Digital Vaccine (DV) packages released on and after January 16, 2018. The 3.2.0 DV package will be at a size that TOS v3.6.6 and earlier can no longer support. For complete details refer to the TOS v3.6.7 Release Notes found on Trend Micro TippingPoint Threat Management Center (TMC) website.

Zero-Day Filters

There are five new zero-day filters from three vendors in this week’s Digital Vaccine (DV) package. A number of existing filters in this week’s DV package were modified to update the filter description, update specific filter deployment recommendation, increase filter accuracy and/or optimize performance. You can browse the list of published advisories and upcoming advisories on the Zero Day Initiative website. You can also follow the Zero Day Initiative on Twitter @thezdi and on their blog.

Adobe (3)

• 29946: ZDI-CAN-5152: Zero Day Initiative Vulnerability (Adobe Acrobat Pro DC)

• 29947: ZDI-CAN-5153: Zero Day Initiative Vulnerability (Adobe Acrobat Pro DC)

• 29950: ZDI-CAN-5204: Zero Day Initiative Vulnerability (Adobe Acrobat Pro DC)

Advantech (1)

• 30100: HTTP: Advantech WebAccess RtspVapgDecoderNew2 Vulnerable ActiveX Method Usage(ZDI-17-531,ZDI-17-563)

Trend Micro (1)

• 30099: HTTP: Trend Micro Control Manager CCGIServlet SuspiciousThreat parameters SQL Injection (ZDI-17-089)

Missed Last Week’s News?

Catch up on last week’s news in my weekly recap.