This month's update for our AppDetectivePRO and DbProtect Knowledgebase is now available.
Knowledgebase version 4.50 includes new and/or updated checks for vulnerabilities in SAP (Sybase) ASE, Microsoft Azure SQL Database, Oracle Database, Hadoop and MySQL.
New Vulnerability and Configuration Check Highlights
SAP (Sybase) ASE
- Probe account access without a password
- Verifies that the server is not vulnerable to the probe login access vulnerability
- Martin Rakhmanov of Trustwave SpiderLabs discovered this vulnerability
- Risk: High
- Relevant CVEs: CVE-2014-8284
Microsoft Azure SQL Database
- Contained database user with password found
- Lists contained database users
- Risk: Informational
- Relevant CVEs: N/A
Oracle
- List of all common users
- Lists all common users in the multi-tenant database
- Risk: Informational
- Relevant CVEs: N/A
MySQL
- Disable symbolic link support
- Verifies that the server is started with the –skip-symbolic-links
- Risk: Low
- Relevant CVEs: N/A
- Old password hashing enabled
- Verifies that the system variable 'old_passwords' is set to OFF.
- Risk: Medium
- Relevant CVEs: N/A
- Permissions on SSL files
- Lists permissions on SSL files on the server
- Risk: Informational
- Relevant CVEs: N/A
- Permissions on binary log files
- Lists permissions on server binary log files
- Risk: Informational
- Relevant CVEs: N/A
- Permissions on configuration files
- Lists permissions on server configuration files
- Risk: Informational
- Relevant CVEs: N/A
Updated Checks
Hadoop
- Latest release not installed
- Support for versions 2.6.0, 1.2.1 and 0.23.11
- Risk: Low
- Relevant CVEs: N/A
- Latest release not installed on time
- Support for versions 2.6.0, 1.2.1 and 0.23.11
- Risk: High
- Relevant CVEs: N/A
SAP (Sybase) ASE
- Latest patch not applied
- Check for Sybase ASE 15.7 SP134
- Risk: High
- Relevant CVEs: N/A
- Latest patch not applied on time
- Check for Sybase ASE 15.7 SP134
- Risk: High
- Relevant CVEs: N/A
Oracle
- More than 20 checks updated to support Oracle 12c multi-tenancy mode (PDB)
Policy Updates
DISA-STIG
- New policy and framework for Microsoft SQL Server 2012 to support V1 R6
- New policy and framework for Oracle 11g to support V8 R13
- New policy and framework for Oracle 11gR2 to support V1 R3
How to Update?
All AppDetectivePRO and DbProtect customers can download the latest Knowledgebase Update 4.50 by visiting the Trustwave support portal at trustwave support and selecting either the AppDetectivePRO or DbProtect product.
AppDetectivePRO customers can also update their deployment by launching the "Updater" within the product.