BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

When Your Vulnerability Scanner Breaks Your Compliance

Posted August 30, 2010    Marc Maiffret

At eEye Digital Security we strive to make sure our Retina Network Security Scanner technology not only has great auditing capabilities for missing patches and misconfigurations, but also for remotely exploitable server vulnerabilities. We have been a pioneer in the space of non-intrusive, unauthenticated, vulnerability checks for many years now. In fact, on more than one occasion competitors have actually “borrowed” our vulnerability check logic within their products. Sometimes this was to the point of us calling these vendors out and making sure they at least give us credit for the work they “borrowed.”

Recently there was a vulnerability found within ColdFusion that would allow for a remote directory traversal attack which you could use to compromise ColdFusion servers. The Retina team worked diligently to develop and release a remote unauthenticated, non-intrusive, audit for this vulnerability (CVE-2010-2861). Now a remote directory traversal attack itself can be tested in a pretty straight forward manner without being intrusive in the sense of crashing a system. There are however many nuances that come into play with auditing for vulnerabilities and these nuances are what can separate the true leaders in vulnerability scanning.

In the case of the ColdFusion vulnerability there are multiple entry points that can be used to exploit a system. In some cases IT environments might have already filtered out, using IDS/IPS, some attack vectors. If a vulnerability scanner only checks for a single attack vector it can miss a vulnerability and mistakenly think the target scan system is secure when it is not. In the case of Retina we actually verify if ColdFusion is vulnerable or not using multiple attack vectors so we give you a clear picture of how vulnerable you are in the same way an attacker would be targeting your organization.

Another nuance as it relates to directory traversal vulnerabilities is in determining what remote file you should access/read across the network in order to determine if a system is vulnerable. One of the most common files we see competitors remotely use in their directory traversal checks is the remote systems password file. To be clear though, when competitors do this they are not simply just verifying if the vulnerability exists by checking for the presence of the password file, but instead they are actually reading the remote password file…or to be more specific they are in essence downloading your servers password file in clear text, unencrypted, across your network. In the case of our audits, such as this ColdFusion vulnerability, we go the extra mile to make sure we do not have to download password files, but instead rely on other files or methods to determine the vulnerability without actually exposing your organization to risk. Not to mention a lot of corporate and government security standards now mandate that passwords cannot be sent in the clear. You would not think your vulnerability assessment product is violating such mandates but in reality a lot of them are every time you audit your network.

At eEye our combination of top notch research and engineering allows us to not only provide vulnerability management solutions that scale, whether it is 50 devices or 5 million, but with the attention to detail in every single audit we create to not only be the most robust but also the most intelligent.

Tags:
, , ,

Leave a Reply

Additional articles

Restricted Area Sign

Implementing Least Privilege for Windows the Easy Way

Posted July 31, 2014    Morey Haber

The concept of least privilege states that asset users should have the lowest level of access privileges required to effectively conduct their jobs. Implementing least privilege can bring several benefits to your organization, including: Increased security by reducing the attack surface available to users and to potential attackers who compromise user systems via phishing, malware,…

Tags:
, , ,
gartner market guide image - aug 2014

Introducing the Gartner Market Guide for Privileged Account Management

Posted July 29, 2014    Chris Burd

Gartner recently released a new Market Guide for Privileged Account Management (PAM), and we’d like to share a complimentary copy with you. The report includes PAM market analysis and direction, vendor overviews, and recommendations for selecting PAM solutions for your environment. BeyondTrust is one of two representative vendors (out of 20) to address all solution…

Tags:
, , , , , , , ,
Integrating Least Privilege and Password Management to Solve Account Security Challenges

Integrating Least Privilege and Password Management to Solve Account Security Challenges

Posted July 24, 2014    Morey Haber

There is a reason all BeyondTrust Privileged Account Management (PAM) solutions share the PowerBroker name: They all inherently enable you to reduce user-based risk and can be integrated under a centralized IT risk management platform. Here’s one common use case that demonstrates how this integration changes the playing field. Consider the challenge of privileged access:…

Tags:
, , , , ,