BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

When Your Vulnerability Scanner Breaks Your Compliance

Posted August 30, 2010    Marc Maiffret

At eEye Digital Security we strive to make sure our Retina Network Security Scanner technology not only has great auditing capabilities for missing patches and misconfigurations, but also for remotely exploitable server vulnerabilities. We have been a pioneer in the space of non-intrusive, unauthenticated, vulnerability checks for many years now. In fact, on more than one occasion competitors have actually “borrowed” our vulnerability check logic within their products. Sometimes this was to the point of us calling these vendors out and making sure they at least give us credit for the work they “borrowed.”

Recently there was a vulnerability found within ColdFusion that would allow for a remote directory traversal attack which you could use to compromise ColdFusion servers. The Retina team worked diligently to develop and release a remote unauthenticated, non-intrusive, audit for this vulnerability (CVE-2010-2861). Now a remote directory traversal attack itself can be tested in a pretty straight forward manner without being intrusive in the sense of crashing a system. There are however many nuances that come into play with auditing for vulnerabilities and these nuances are what can separate the true leaders in vulnerability scanning.

In the case of the ColdFusion vulnerability there are multiple entry points that can be used to exploit a system. In some cases IT environments might have already filtered out, using IDS/IPS, some attack vectors. If a vulnerability scanner only checks for a single attack vector it can miss a vulnerability and mistakenly think the target scan system is secure when it is not. In the case of Retina we actually verify if ColdFusion is vulnerable or not using multiple attack vectors so we give you a clear picture of how vulnerable you are in the same way an attacker would be targeting your organization.

Another nuance as it relates to directory traversal vulnerabilities is in determining what remote file you should access/read across the network in order to determine if a system is vulnerable. One of the most common files we see competitors remotely use in their directory traversal checks is the remote systems password file. To be clear though, when competitors do this they are not simply just verifying if the vulnerability exists by checking for the presence of the password file, but instead they are actually reading the remote password file…or to be more specific they are in essence downloading your servers password file in clear text, unencrypted, across your network. In the case of our audits, such as this ColdFusion vulnerability, we go the extra mile to make sure we do not have to download password files, but instead rely on other files or methods to determine the vulnerability without actually exposing your organization to risk. Not to mention a lot of corporate and government security standards now mandate that passwords cannot be sent in the clear. You would not think your vulnerability assessment product is violating such mandates but in reality a lot of them are every time you audit your network.

At eEye our combination of top notch research and engineering allows us to not only provide vulnerability management solutions that scale, whether it is 50 devices or 5 million, but with the attention to detail in every single audit we create to not only be the most robust but also the most intelligent.

Tags:
, , ,

Leave a Reply

Additional articles

webinar_ondemand

On Demand Webinar – Why You Still Suck at Patching

Posted March 27, 2015    Lindsay Marsh

On Demand Webinar: Dave Shackleford recounts some of his personal experiences in patch management failure, and breaks down the most critical issues holding many teams back from patching more effectively.

Tags:
,
dave-shackleford-headshot

Why You Still Suck at Patching…and How to Turn Your Life Around

Posted March 25, 2015    Dave Shackleford

Live webinar | March 26, 2015 | 10am PT/1pm ET | Dave Shackleford, SANS Instructor | Why You Still Suck at Patching…and How to Turn Your Life Around

Tags:
, ,
infographic

Privilege Gone Wild 2: Over 25% of Organizations Have No Privileged Access Controls

Posted March 24, 2015    Scott Lang

BeyondTrust recently conducted a survey, with over 700 respondents, to explore how organizations view the risk of misuse from privileged account misuse, as well as trends in addressing and mitigating those risks.

Tags:
,