Database Security Knowledgebase Update 5.11

This month's update for Database Security Knowledgebase is now available.

Knowledgebase version 5.11 includes new checks for MySQL, SQL Server and Oracle as well as updated checks for SQL Server andMySQL.

New Vulnerability and Configuration Check Highlights

MySQL

SQL Server

  • Disable Filestream Feature
    • Check that the Filestream feature is disabled
    • Risk: Informational
    • Relevant CVEs: N/A
  • Server is Synchronized with an official time server
    • Verify that the Windows operating system is configured to synchronize with an official time server, using Network Time Protocol (NTP)
    • Risk: Medium
    • Relevant CVEs: N/A

Oracle

  • Critical Patch Update/Patch Set Update – January 2017
    • Check version to determine if the database contains vulnerabilities described by Critical Patch Update/Patch Set Update - January 2017
    • Risk: High
    • Relevant CVEs:CVE-2017-3240CVE-2017-3310

Updated Checks

SQL Server

  • Latest service pack/hot fix not applied
    • Latest service pack/hot fix not applied. Updated to check for Microsoft SQL Server 2016 Service Pack 1
    • Risk: High
    • Relevant CVEs: N/A
  • Service pack not applied on time
    • Updated to check for Microsoft SQL Server 2016 Service Pack 1
    • Risk: High
    • Relevant CVEs: N/A

MySQL

  • Latest release not installed
    • Support MySQL 5.5.54, 5.6.35 and 5.7.17
    • Risk: High
    • Relevant CVEs: N/A
  • Release update not installed on time
    • Support MySQL 5.5.54, 5.6.35 and 5.7.17
    • Risk: High
    • Relevant CVEs: N/A

Availability

  • Available to allAppDetectivePRO and DbProtect customers with maintenance (subscription or perpetual) in good standing at no additional cost
  • Download SHATTER Knowledgebase from the Trustwave Support Portal (https://www.trustwave.com/Company/Support/ and select AppDetectivePRO or DbProtect)
  • AppDetectivePRO customers can use the Updater within the product as well

Trustwave reserves the right to review all comments in the discussion below. Please note that for security and other reasons, we may not approve comments containing links.