BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

When Your Vulnerability Scanner Breaks Your Compliance

Posted August 30, 2010    Marc Maiffret

At eEye Digital Security we strive to make sure our Retina Network Security Scanner technology not only has great auditing capabilities for missing patches and misconfigurations, but also for remotely exploitable server vulnerabilities. We have been a pioneer in the space of non-intrusive, unauthenticated, vulnerability checks for many years now. In fact, on more than one occasion competitors have actually “borrowed” our vulnerability check logic within their products. Sometimes this was to the point of us calling these vendors out and making sure they at least give us credit for the work they “borrowed.”

Recently there was a vulnerability found within ColdFusion that would allow for a remote directory traversal attack which you could use to compromise ColdFusion servers. The Retina team worked diligently to develop and release a remote unauthenticated, non-intrusive, audit for this vulnerability (CVE-2010-2861). Now a remote directory traversal attack itself can be tested in a pretty straight forward manner without being intrusive in the sense of crashing a system. There are however many nuances that come into play with auditing for vulnerabilities and these nuances are what can separate the true leaders in vulnerability scanning.

In the case of the ColdFusion vulnerability there are multiple entry points that can be used to exploit a system. In some cases IT environments might have already filtered out, using IDS/IPS, some attack vectors. If a vulnerability scanner only checks for a single attack vector it can miss a vulnerability and mistakenly think the target scan system is secure when it is not. In the case of Retina we actually verify if ColdFusion is vulnerable or not using multiple attack vectors so we give you a clear picture of how vulnerable you are in the same way an attacker would be targeting your organization.

Another nuance as it relates to directory traversal vulnerabilities is in determining what remote file you should access/read across the network in order to determine if a system is vulnerable. One of the most common files we see competitors remotely use in their directory traversal checks is the remote systems password file. To be clear though, when competitors do this they are not simply just verifying if the vulnerability exists by checking for the presence of the password file, but instead they are actually reading the remote password file…or to be more specific they are in essence downloading your servers password file in clear text, unencrypted, across your network. In the case of our audits, such as this ColdFusion vulnerability, we go the extra mile to make sure we do not have to download password files, but instead rely on other files or methods to determine the vulnerability without actually exposing your organization to risk. Not to mention a lot of corporate and government security standards now mandate that passwords cannot be sent in the clear. You would not think your vulnerability assessment product is violating such mandates but in reality a lot of them are every time you audit your network.

At eEye our combination of top notch research and engineering allows us to not only provide vulnerability management solutions that scale, whether it is 50 devices or 5 million, but with the attention to detail in every single audit we create to not only be the most robust but also the most intelligent.

Tags:
, , ,

Leave a Reply

Additional articles

pbps-blog2

8 Reasons Your Privileged Password Management Solution Will Fail

Posted September 18, 2014    Chris Burd

Leveraging complex, frequently updated passwords is a basic security best practice for protecting privileged accounts in your organization. But if passwords are such a no-brainer, why do two out of three data breaches tie back to poor password management? The fact is that not all privileged password management strategies are created equal, so it’s critical…

Tags:
, , , , , ,
pbps-customer-campaign-image

You Change Your Oil Regularly; Why Not Your Passwords?

Posted September 11, 2014    Chris Burd

There are many things in life that get changed regularly:  your car oil, toothbrush and hopefully, your bed sheets.  It’s rare that you give these things much thought – even when you forget to change them. But what if you’re forgetting something that can cost you millions of dollars if left unchanged for long periods…

Tags:
, , ,

On-Demand Webcast: The Little JPEG that Could (Hack Your Organization) with Marcus Murray

Posted September 10, 2014    Chris Burd

IT security has come a long way, but every once in a while you see something that makes you think otherwise. Every day, internal and external hackers breach and traverse “secure” environments, making you wonder just how easy it is for attackers to completely compromise your network. In a new on-demand BeyondTrust webcast, Marcus Murray,…

Tags:
, , , , ,