This month's update for our AppDetectivePRO and DbProtect Knowledgebase is now available.
Knowledgebase version 4.49 includes a total of five new checks for vulnerabilities in MySQL, Microsoft Azure SQL Database, and Oracle Database and new and updated checks for MySQL and Oracle.
New Vulnerability and Configuration Check Highlights
MySQL
- Critical Patch Update – April 2015
- Check the version to determine whether the database contains vulnerabilities described by Critical Patch Update – April 2015
- Risk: High
- Relevant CVEs: CVE-2014-3569, CVE-2015-0405, CVE-2015-0423, CVE-2015-0433, CVE-2015-0438, CVE-2015-0439, CVE-2015-0441, CVE-2015-0498, CVE-2015-0499, CVE-2015-0500, CVE-2015-0501, CVE-2015-0503, CVE-2015-0505, CVE-2015-0506, CVE-2015-0507, CVE-2015-0508, CVE-2015-0511, CVE-2015-2566, CVE-2015-2567, CVE-2015-2568, CVE-2015-2571, CVE-2015-2573
- Permissions on the data directory
- Verifies permissions on the data directory and alerts on inappropriate write privileges.
- Risk: Medium
- Relevant CVEs: N/A
- Permissions on binaries
- Lists permissions for MySQL binaries.
- Risk: Informational
- Relevant CVEs: N/A
Microsoft Azure SQL Database
- Application role privilege assignment
- Lists privileges assigned to application roles.
- Risk: Informational
- Relevant CVEs: N/A
Oracle
- Critical Patch Update/Patch Set Update – April 2015
- Check version to determine whether the database contains vulnerabilities described by Critical Patch Update – April 2015Reports list of all user-created PDBs in the CDB.
- Risk: High
- Relevant CVEs: CVE-2015-0455, CVE-2015-0457, CVE-2015-0479, CVE-2015-0483
Updated Checks
MySQL
- Latest release not installed (MySQL 5.5.42 and 5.6.24)
- Risk: High
- Relevant CVEs: N/A
- Latest release not installed on time, default set to within 30 days (MySQL 5.5.42 and 5.6.24)
- Risk: High
- Relevant CVEs: N/A
Oracle
- Critical Patch Update not applied on time, default set to within 30 days (Critical Patch Update – April 2015)
- Risk: High
- Relevant CVEs: N/A
Notable Changes and Fixes
- KB-3311—Updated Oracle Check—Password based on username—details reporting in all CAPS
How to Update?
All AppDetectivePRO and DbProtect customers can download the latest Knowledgebase Update 4.49 by visiting the Trustwave support portal at https://trustwave.com/Company/Support and selecting either the AppDetectivePRO or DbProtect product.
AppDetectivePRO customers can also update their deployment by launching the "Updater" within the product.
