Tenable Blog

Tenable Network Security Podcast Episode 133 - "Detecting Mobile Device Vulnerabilities Using Nessus"

by Paul Asadoorian on July 19, 2012

Announcements

We're hiring! - Visit the Tenable website for more information about open positions.
Check out our video channel on YouTube which contains new Nessus and SecurityCenter 4 tutorials.
Tenable Tweets - You can find us on Twitter at http://twitter.com/tenablesecurity where we make product and company announcements, provide Nessus plugin statistics, and more!
Want to ask questions about Nessus, SecurityCenter, LCE, and PVS and get answers from the experts at Tenable? Join Tenable's Discussion Forum for custom scripts, announcements, and more!
You can subscribe to the Tenable Network Security Podcast on iTunes!

New & Notable Plugins

Nessus

If a Security Control Falls in the Forest...

by Paul Asadoorian on July 16, 2012

Many guidelines and compliance standards state that in order to be "secure" or "compliant" all of your systems must be patched. Turns out that this is easier said than done. Just when you believe your systems to be patched, something fails and patches seemingly disappear. We can then apply the "falling off" principal to several other areas of information technology, such as web applications, configuration management, and antivirus software. How do security controls in these areas fall off? Read about how this might happen and what you can do to help correct the problems.

Tenable Network Security Podcast Episode 132 - "Default Passwords, Evil QR Codes"

by Paul Asadoorian on July 11, 2012

Announcements

We're hiring! - Visit the Tenable website for more information about open positions.
Check out our video channel on YouTube which contains new Nessus and SecurityCenter 4 tutorials.
Tenable Tweets - You can find us on Twitter at http://twitter.com/tenablesecurity where we make product and company announcements, provide Nessus plugin statistics, and more!
Want to ask questions about Nessus, SecurityCenter, LCE, and PVS and get answers from the experts at Tenable? Join Tenable's Discussion Forum for custom scripts, announcements, and more!
You can subscribe to the Tenable Network Security Podcast on iTunes!

New & Notable Plugins

Nessus

Microsoft IIS 6.0 PHP NTFS Stream Authentication Bypass - Using an alternative data stream, attackers are able to access PHP files which are otherwise protected. This is accomplished by accessing a file using the following name: "filename.php::$INDEX_ALLOCATION" as it is the functional equivalent of "filename.php".
VMware Fusion 4.x Less Than 4.1.3 Vulnerabilities - "Due to a flaw in the virtual floppy configuration it is possible to perform an out-of-bounds memory write. This vulnerability may allow a guest user to crash the VMX process or potentially execute code on the host." Do many still use a virtual floppy disk?
Cisco AnyConnect Secure Mobility Client VPN Downloader Arbitrary Code Execution - "Such versions are potentially affected by an arbitrary code execution vulnerability." Potentially? I really wish vendors would do a better job of further qualifying the risk of exploitation. Upgrading all of your clients is not an easy task, and security folks may have a tough time convincing administrators to push out a fix if the risk is not a reality.
MacOSX Cisco AnyConnect Secure Mobility Client Multiple Vulnerabilities - Looks like these problems exist on OS X as well. The AnyConnect client does not validate binary downloads, allowing an attacker to execute code.
Symantec Message Filter Management Interface Default Credentials - I believe one of the security measures that gives you the most bang for your buck is to make certain all of your management interfaces are not using default or easily-guessable credentials.
IBM Lotus Domino Password Protected DB Enumeration - Tools exist in the popular Metasploit framework to brute force this password.
Basilic diff.php Command Injection - "Basilic, a bibliography server for research laboratories, has a command injection vulnerability."
HP System Management Homepage Less Than 7.1.1 Vulnerabilities - This update files a long list of vulnerabilities.
IrfanView JPEG-2000 Plugin Remote Stack-based Buffer Overflow - Remote code execution triggered by opening JP2 files.
Cisco WebEx ARF Player Buffer Overflow - I suppose you could host an "evil" webcast and trigger this buffer overflow condition!

Are You at Risk for Burnout? The Top Causes…and a Sneak Peek at Findings from a New Tenable Study

by Jack Daniel on July 9, 2012

Around the time of RSA in February, I wrote about the risk of burnout for security professionals, and offered some warning signs — including feelings of stress, exhaustion, or a lack of self-efficacy — that might indicate you’re on the burnout scale.

At this year’s Gartner Security and Risk Management Summit, the Tenable team decided to dig a little deeper and conducted a survey that explores a number of security issues, including some of the causes of burnout.

Keep a look out for the official numbers in the coming weeks. In the meanwhile, here are three questions you should ask yourself — based on the early survey findings — to prevent security burnout before you’re on the scale.

Are you working too many hours?

The study found that working 50 hours a week isn’t just ordinary — it’s the minimum for most security pros. In fact, the vast majority of respondents said they work between 70 and 80 hours every week.

There are two schools of thought to consider here. First, security pros see the economic turmoil that surrounds them and are willing to do more to keep their jobs. Or second, security pros have more work (and responsibility) than they can realistically handle. The second option feels more realistic to me, which leads me to my next question…

Tenable Network Security Podcast Episode 131 - "Botnet Hosts, Management from the Cloud"

by Paul Asadoorian on July 3, 2012

Announcements

We're hiring! - Visit the Tenable website for more information about open positions.
Check out our video channel on YouTube which contains new Nessus and SecurityCenter 4 tutorials.
Tenable Tweets - You can find us on Twitter at http://twitter.com/tenablesecurity where we make product and company announcements, provide Nessus plugin statistics, and more!
Want to ask questions about Nessus, SecurityCenter, LCE, and PVS and get answers from the experts at Tenable? Join Tenable's Discussion Forum for custom scripts, announcements, and more!
You can subscribe to the Tenable Network Security Podcast on iTunes!

New & Notable Plugins

Nessus

Active Inbound Connection From Host Listed in Known Bot Database - The ability to identify whether a host is connecting to a host in a botnet, or a host in a botnet is connected to it, is important information.
Cisco ASA 5500 Series DoS - I lost track of how many times I've been taunted with the words, "I'm gonna DoS your firewall!" Oh wait, that was just something I heard in the movies and on TV. Turns out it's a reality if you're using an ASA firewall configured with IPv6. I wonder just how many more vulnerabilities are going to crop up for IPv6 protocol stacks (we even see IPv4 vulnerabilities crop up now and again!).
Malicious Process Detection: Potentially Unwanted Software - Nessus now makes the distinction between malware and software that could be used for "evil" but has a chance of not being malicious (like Netcat).
MikroTik Winbox Less Than 5.17 File Download DoS - " An unauthenticated, remote attacker may make multiple requests to download a large file, resulting in the service becoming unresponsive." MikroTik makes some super cool hardware too, fantastic wireless access points. They have their own operating system called RouterOS, however, this vulnerability is in a utility called Winbox used to configure the operating system.
Oracle iPlanet Web Server Between 7.0 and 7.0.15 Vulnerabilities - Looks like some XSS vulnerabilities and one bug called "Range Header DoS" are listed as "could not be reproduced."
Winamp Less Than 5.63 Vulnerabilities - Winamp is still going strong with all kinds of software products for media. Turns out they have some vulnerabilities that have been corrected.
ACDSee Pro Less Tan 5.2 Memory Corruption Vulnerabilities - No, not the great classic rock band, the image editing application! They have patched four heap overflows, and something about being a long way to the top if you want to heap overflow.
HAProxy Trash Buffer Overflow Vulnerability - HAProxy is a load balancer, have to make sure this type of device is always patched as even DoS vulnerabilities can be severe (though this one happens to be a buffer overflow). There are some mitigating circumstances: "It requires that the global.tune.bufsize option is set to a value greater than default and that header rewriting is configured."
Quagga Less Than 0.99.19 Vulnerabilities - For those that may not know: "Quagga is a routing software suite, providing implementations of OSPFv2, OSPFv3, RIP v1 and v2, RIPng and BGP-4 for Unix platforms, particularly FreeBSD, Linux, Solaris and NetBSD. Quagga is a fork of GNU Zebra which was developed by Kunihiro Ishiguro." We recently published quite a few plugins to detect vulnerabilities on this platform.

Plugin Updates: Malicious Process & Botnet Detection

by Paul Asadoorian on June 29, 2012

Malicious Process Detection Updates

A short time ago, Tenable released a new plugin to perform Malicious Process Detection (plugin ID 59275). Originally, it identified all possible malicious processes and reported the risk level as "High." This has now been split into two plugins; the original plugin that detects processes as malware which now uses the risk level of "critical," and a new plugin titled Malicious Process Detection: Potentially Unwanted Software (plugin ID 59641):

Click for larger image

The difference between the two plugins is the intent of the malicious software. For example, "Netcat" is a popular tool that can be used for network troubleshooting or by attackers for "evil" purposes such as backdoors. These two separate malware plugins will allow customers to more easily differentiate between policy violations and systems that are infected with malware unmistakable for any legitimate program.

Tenable Network Security Podcast Episode 130 - "DLL Injection, WAF vs. Developers"

by Paul Asadoorian on June 28, 2012

Announcements

We're hiring! - Visit the Tenable website for more information about open positions.
Check out our video channel on YouTube which contains new Nessus and SecurityCenter 4 tutorials.
Tenable Tweets - You can find us on Twitter at http://twitter.com/tenablesecurity where we make product and company announcements, provide Nessus plugin statistics, and more!
Want to ask questions about Nessus, SecurityCenter, LCE, and PVS and get answers from the experts at Tenable? Join Tenable's Discussion Forum for custom scripts, announcements, and more!
You can subscribe to the Tenable Network Security Podcast on iTunes!

New & Notable Plugins

Nessus

Log Correlation Engine Version 4 Now Available

by Dale Gardner on June 27, 2012

One of the more vexing challenges security practitioners and managers face is determining –- quickly and accurately –- which of the myriad of events, alerts, and warnings they receive on a continuous basis is most deserving of their attention. Tenable's Unified Security Monitoring (USM) solution uniquely solves that challenge by integrating active and passive vulnerability management with SIEM capabilities –- providing a contextualized and prioritized view of events and activity.

CEO Ron Gula on Log Correlation Engine Version 4

by Dale Gardner on June 27, 2012

Tenable CEO and CTO Ron Gula took a few minutes to talk about some of the important new features of Log Correlation Engine (LCE) version 4. Watch now on Tenable's YouTube Channel:

Tenable Network Security Podcast Episode 129 - "More RDP Vulnerabilities, Hacking Back?"

by Paul Asadoorian on June 21, 2012

Announcements

Tenable Network Security Reveals the Next Generation of Its SIEM Solution
We're hiring! - Visit the Tenable website for more information about open positions.
Check out our video channel on YouTube which contains new Nessus and SecurityCenter 4 tutorials.
Tenable Tweets - You can find us on Twitter at http://twitter.com/tenablesecurity where we make product and company announcements, provide Nessus plugin statistics, and more!
Want to ask questions about Nessus, SecurityCenter, LCE, and PVS and get answers from the experts at Tenable? Join Tenable's Discussion Forum for custom scripts, announcements, and more!
You can subscribe to the Tenable Network Security Podcast on iTunes!

New & Notable Plugins

Nessus

MS12-036: Vulnerability in Remote Desktop Could Allow Remote Code Execution - I find it interesting that the first vulnerability came from TippingPoint's ZDI program, which listed it as a remote code execution. Now we have a second remote code execution in the same protocol. Organizations really need to get a handle on controls for this service, and if you're using it make certain it's configured properly and patched.
Citrix Provisioning Services Unspecified Request Parsing Remote Code Execution (uncredentialed check) - The concept of providing virtual desktops and being able to roll them back to a "clean" state once the user logs off is useful. However, this is a case where software that helps you implement security contains vulnerabilities. This exploit comes from iDefense, and one released early this year came from TippingPoint.
F5 Multiple Products Root Authentication Bypass - If you are running F5 products that are vulnerable, patch immediately. Turns out they all use the same private SSH key, giving attackers an easy way to gain access to them.
Asterisk Remote Crash Vulnerability in Skinny Channel Driver - Note there are many products that embed Asterisk to provide VoIP functionality.
iTunes 10.6.3 Multiple Vulnerabilities (uncredentialed check) - Apple references this vulnerability with regards to both OS X and Windows platforms.
PHP 5.3.x 5.3.14 Multiple Vulnerabilities - Public exploit code is available.
RuggedOS Web-Based Admin Interface Default Credentials - Coming off the heels of the Telnet backdoor, RuggedOS also uses a default password on the web management interface.

Tenable Blog

Announcements

New & Notable Plugins

Nessus

Announcements

New & Notable Plugins

Nessus

Are you working too many hours?

Announcements

New & Notable Plugins

Nessus

Malicious Process Detection Updates

Announcements

New & Notable Plugins

Nessus

Announcements

New & Notable Plugins

Nessus

Tenable Vulnerability Management

Tenable Vulnerability Management

Thank You

Tenable Vulnerability Management

Tenable Vulnerability Management

Thank you

Tenable Vulnerability Management

Tenable Vulnerability Management

Thank you

Try Tenable Web App Scanning

Buy Tenable Web App Scanning

Thank you

Try Tenable Lumin

Buy Tenable Lumin

Thank you

Request a demo of Tenable Security Center

Request a demo of Tenable OT Security

Request a demo of Tenable Identity Exposure

Request a demo of Tenable Cloud Security

See Tenable One in action

See Tenable Attack Surface Management in action

Get a demo of Tenable Enclave Security

Thank You

Try Tenable Nessus Professional free

NEW - Tenable Nessus Expert now available

Buy Tenable Nessus Professional

Try Tenable Nessus Expert free

Buy Tenable Nessus Expert

Learn How Tenable Helps Achieve SLCGP Cybersecurity Plan Requirements

See
Tenable One
in action

NEW - Tenable Nessus Expert
now available