BeyondTrust

Security In Context

Bringing you news and commentary on solutions and strategies for protecting your critical IT infrastructure.

When Your Vulnerability Scanner Breaks Your Compliance

Post by Marc Maiffret August 30, 2010

At eEye Digital Security we strive to make sure our Retina Network Security Scanner technology not only has great auditing capabilities for missing patches and misconfigurations, but also for remotely exploitable server vulnerabilities. We have been a pioneer in the space of non-intrusive, unauthenticated, vulnerability checks for many years now. In fact, on more than one occasion competitors have actually “borrowed” our vulnerability check logic within their products. Sometimes this was to the point of us calling these vendors out and making sure they at least give us credit for the work they “borrowed.”

Recently there was a vulnerability found within ColdFusion that would allow for a remote directory traversal attack which you could use to compromise ColdFusion servers. The Retina team worked diligently to develop and release a remote unauthenticated, non-intrusive, audit for this vulnerability (CVE-2010-2861). Now a remote directory traversal attack itself can be tested in a pretty straight forward manner without being intrusive in the sense of crashing a system. There are however many nuances that come into play with auditing for vulnerabilities and these nuances are what can separate the true leaders in vulnerability scanning.

In the case of the ColdFusion vulnerability there are multiple entry points that can be used to exploit a system. In some cases IT environments might have already filtered out, using IDS/IPS, some attack vectors. If a vulnerability scanner only checks for a single attack vector it can miss a vulnerability and mistakenly think the target scan system is secure when it is not. In the case of Retina we actually verify if ColdFusion is vulnerable or not using multiple attack vectors so we give you a clear picture of how vulnerable you are in the same way an attacker would be targeting your organization.

Another nuance as it relates to directory traversal vulnerabilities is in determining what remote file you should access/read across the network in order to determine if a system is vulnerable. One of the most common files we see competitors remotely use in their directory traversal checks is the remote systems password file. To be clear though, when competitors do this they are not simply just verifying if the vulnerability exists by checking for the presence of the password file, but instead they are actually reading the remote password file…or to be more specific they are in essence downloading your servers password file in clear text, unencrypted, across your network. In the case of our audits, such as this ColdFusion vulnerability, we go the extra mile to make sure we do not have to download password files, but instead rely on other files or methods to determine the vulnerability without actually exposing your organization to risk. Not to mention a lot of corporate and government security standards now mandate that passwords cannot be sent in the clear. You would not think your vulnerability assessment product is violating such mandates but in reality a lot of them are every time you audit your network.

At eEye our combination of top notch research and engineering allows us to not only provide vulnerability management solutions that scale, whether it is 50 devices or 5 million, but with the attention to detail in every single audit we create to not only be the most robust but also the most intelligent.

Tags:
, , ,

Leave a Reply

Additional articles

April VEF Participant Wins a Apple iPad mini

Every month we host our Vulnerability Expert Forum (VEF) webinar. This is a time where our experts share valuable insight regarding new vulnerabilities that are discovered and the actions that need to be taken as a result. It’s a quick way to get up to speed on current potential risks to your organization and a way to…

Post by Qui Cao April 24, 2014
smart rules manager for vulnerabilities - v2

A New Way of Looking at Vulnerabilities in Your Environment

Assets, users, vulnerabilities and exploits; all are common themes in my posts on BeyondInsight. With BeyondInsight v5.1, we unveiled a new way to view exploitable assets. Sure, most vulnerability management solutions link vulnerability data to exploit information, allowing tools like NeXpose and QualysGuard to list an asset, its vulnerabilities, and any related exploits. BeyondInsight does…

Post by Morey Haber April 23, 2014
Tags:
, , , , ,
smart rules manager for vulnerabilities

Staying on Top of the Latest Vulnerabilities with BeyondInsight v5.1

It’s no secret that dozens of new OS and application vulnerabilities are revealed every day. Staying on top of these new exposures normally requires paying for services or subscribing to multiple RSS feeds. BeyondInsight 5.1 provides customers with another option: a built-in, customizable vulnerability alerting system that delivers up-to-date information on the latest vulnerabilities in…

Post by Morey Haber April 21, 2014
Tags:
, , , , , ,