Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

When Your Vulnerability Scanner Breaks Your Compliance

Posted August 30, 2010    Marc Maiffret

At eEye Digital Security we strive to make sure our Retina Network Security Scanner technology not only has great auditing capabilities for missing patches and misconfigurations, but also for remotely exploitable server vulnerabilities. We have been a pioneer in the space of non-intrusive, unauthenticated, vulnerability checks for many years now. In fact, on more than one occasion competitors have actually “borrowed” our vulnerability check logic within their products. Sometimes this was to the point of us calling these vendors out and making sure they at least give us credit for the work they “borrowed.”

Recently there was a vulnerability found within ColdFusion that would allow for a remote directory traversal attack which you could use to compromise ColdFusion servers. The Retina team worked diligently to develop and release a remote unauthenticated, non-intrusive, audit for this vulnerability (CVE-2010-2861). Now a remote directory traversal attack itself can be tested in a pretty straight forward manner without being intrusive in the sense of crashing a system. There are however many nuances that come into play with auditing for vulnerabilities and these nuances are what can separate the true leaders in vulnerability scanning.

In the case of the ColdFusion vulnerability there are multiple entry points that can be used to exploit a system. In some cases IT environments might have already filtered out, using IDS/IPS, some attack vectors. If a vulnerability scanner only checks for a single attack vector it can miss a vulnerability and mistakenly think the target scan system is secure when it is not. In the case of Retina we actually verify if ColdFusion is vulnerable or not using multiple attack vectors so we give you a clear picture of how vulnerable you are in the same way an attacker would be targeting your organization.

Another nuance as it relates to directory traversal vulnerabilities is in determining what remote file you should access/read across the network in order to determine if a system is vulnerable. One of the most common files we see competitors remotely use in their directory traversal checks is the remote systems password file. To be clear though, when competitors do this they are not simply just verifying if the vulnerability exists by checking for the presence of the password file, but instead they are actually reading the remote password file…or to be more specific they are in essence downloading your servers password file in clear text, unencrypted, across your network. In the case of our audits, such as this ColdFusion vulnerability, we go the extra mile to make sure we do not have to download password files, but instead rely on other files or methods to determine the vulnerability without actually exposing your organization to risk. Not to mention a lot of corporate and government security standards now mandate that passwords cannot be sent in the clear. You would not think your vulnerability assessment product is violating such mandates but in reality a lot of them are every time you audit your network.

At eEye our combination of top notch research and engineering allows us to not only provide vulnerability management solutions that scale, whether it is 50 devices or 5 million, but with the attention to detail in every single audit we create to not only be the most robust but also the most intelligent.

, , ,

Leave a Reply

Additional articles


Closing the Vulnerability Gap

Posted October 7, 2015    Brian Chappell

Managing vulnerabilities is a significant challenge for many organizations. The main difficulties with managing this manifest in two key areas. The first is that the list isn’t static. The second is priority.


Scottrade Breach: Identified by Federal Officials

Posted October 5, 2015    Morey Haber

Late afternoon on October 2nd, news leaked out of another large security breach, now at Scottrade. The identity count of records, in the millions again (4.6 million is the latest). This breach comes on the second day of national CyberSecurity month, the first being Experian/T-Mobile breach.

3d image Data Breach issues concept word cloud background

Experian/T-Mobile Data Breach: When 2 Days is not Enough

Posted October 2, 2015    Morey Haber

On October 1, Experian admitted full responsibility for the loss of T-Mobile customer data. 15 million user records dating back to 2013 were effected in the breach, with data including sensitive information that may be decryptable like social security numbers and drivers licenses.