Popular WordPress Plugin with over half a million installations is potentially vulnerable to unauthenticated blind SQL injection attacks.

Background

On July 1, maintainers of WP Statistics, a popular WordPress plugin for gathering website statistics about visitor data that boasts over 500,000 active installations, released an update to address a serious vulnerability.

Analysis

Researcher Thomas Chauchefoin discovered and reported an unauthenticated blind SQL injection (SQLi) in the WP Statistics plugin versions 12.6.6.1 and lower. The vulnerability exists in a non-default configuration of the plugin. By default, the Cache Plugin setting in WP Statistics is disabled.

However, enabling this setting could allow an unauthenticated remote attacker to pass a blind SQLi command via the WP Statistics API endpoint. Since the SQLi vulnerability affects both SELECT and UPDATE queries, this could potentially be abused to perform a variety of actions, including changing the administrator credentials, adding another administrator account to the vulnerable WordPress site, exfiltrating user data and more.

This isn’t the first SQLi discovered in the WP Statistics plugin. Researchers at Sucuri blogged about their discovery of an SQLi in 2017, and researcher Marcin Probola discovered a blind SQLi in the plugin back in 2015.

Proof of concept

A proof-of-concept (PoC) was shared by the researcher in the WP Vulnerability database posting.

Solution

This vulnerability is addressed in WP Statistics version 12.6.7 or greater. While the vulnerable configuration is not enabled by default, with over a half a million active installations it is likely that a large number of WP Statistics users are vulnerable. All users should upgrade to the latest version of the plugin as soon as possible.

Identifying affected systems

A list of Tenable plugins to identify this vulnerability will appear here as they’re released.

Get more information

• WordPress.org: WP Statistics Plugin
• WP Statistics <= 12.6.6.1 - Unauthenticated Blind SQL Injection

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 60-day trial of Tenable.io Vulnerability Management.

Tenable’s Predictive Prioritization leverages data science and machine learning to make it easier for cybersecurity teams to find, patch and remediate vulnerabilities.  

Week after week, critical vulnerabilities in enterprise software are found and published, sending security teams off in a mad scramble to apply patches in an effort to minimize the damage.

Many times, these exercises are driven not by business needs or even strategic security considerations, but by a reaction to a particular vulnerability in the daily headlines. This scenario plays out again and again, causing unnecessary downtime and stretching already strained cybersecurity resources to the breaking point.

“For anyone involved in dealing with vulnerabilities, we sometimes describe it as the hamster wheel of pain,” said Gavin Millard, Vice President of Product Marketing for Tenable, during a recent webinar, Leveraging the Power of Data Science for Prioritization. 

“Basically, as you are addressing the vulnerabilities that have been discovered, you are going through and remediating these or placing compensating controls to address them. There are more vulnerabilities being discovered [resulting in a] snowball effect of more and more vulnerabilities to deal with,” Millard added.

And, as Millard pointed out, “It doesn’t have to be this way.”

There are ways to leverage disciplines such as data science, along with technology like machine learning, to create a more holistic approach to remediating software vulnerabilities.

A fresh way of thinking about the challenges can help prioritize how CISOs and their security teams react to the daily onslaught of software vulnerabilities, enabling them to allocate resources to patching flaws that truly pose a danger to the business.

That’s where Predictive Prioritization comes in.

Released earlier this year, Predictive Prioritization combines Tenable-collected vulnerability data with third-party vulnerability and threat data and analyzes them together using an advanced data science algorithm developed by Tenable Research. Each vulnerability now receives a Vulnerability Priority Rating (VPR) that incorporates the result of this analysis, updated on a daily basis. The capabilities of Predictive Prioritization give vulnerability management teams a way to score vulnerabilities within the context of their own business needs. 

Solving Vulnerability Management Pain Points

The need for a new approach is illustrated in a recent Ponemon Institute report, Measuring and Managing the Cyber Risks to Business Operations, conducted on behalf of Tenable. For the report, Ponemon surveyed 2,410 IT and IT security practitioners in the United States, United Kingdom, Germany, Australia, Mexico and Japan. 

Half of the respondents (51 percent) said they spend more time on manual processes than they do dealing with vulnerabilities, leading to a massive back-up. Indeed, 48 percent of respondents said the reliance on manual processes puts their organization at a disadvantage when it comes to their ability to respond to vulnerabilities.

Only 39 percent of respondents said they incorporate threat intelligence into prioritizing the assets most important to safeguard. Less than a third of respondents (29 percent) believe they have sufficient insight into their organization’s attack surface.

These are the issues Predictive Prioritization aims to solve: 

• less reliance on manual processes
• giving resource-constrained CISOs access to the latest and greatest threat intelligence; and 
• allowing for a clear view of the entire attack surface at a time when enterprise security is taking on more responsibility.

When Everything Is a Priority… 

According to the National Vulnerability Database (NVD), there were over 16,500 vulnerabilities published in 2018. Of that number, 15 percent were rated 9+ on the CVSS (Common Vulnerability Scoring System) scorecard.

This approach quite simply produces too much noise.

“When everything is critical, nothing is critical,” Millard said during the webinar.

Predictive Prioritization improves on traditional CVSS analysis to create a dynamic score that takes into consideration the actual risk these software flaws pose to the enterprise — as opposed to focusing on the technical sophistication of a particular vulnerability. “CVSS, to me, is like a CV or resume of someone. It tells you just the highlight of that person but it doesn’t tell you the true personality traits and how those traits are leveraged by that individual,” Millard said, citing a Carnegie Mellon University study, Toward Improving CVSS, which found that CVSS is in need of improvements.

In a December 5, 2018, blog post about the CVSS study, Carnegie Mellon faculty member Deana Schick wrote: “CVSS was designed to measure the technical severity of a vulnerability but is widely misused as a means of vulnerability prioritization and assessing risk. The scoring algorithm is not well justified and lacks the transparency needed for the community to understand its intended function. Further, the misuse of CVSS as a risk score means that you are not likely learning what you thought you were learning from it.”

In the Tenable webinar, Millard explained: “CVSS is very technical and focused just on the base, temporal [and] environmental metrics of that vulnerability, and it doesn’t give you the real-world view of the risk that vulnerability poses.” 

The Vulnerability Priority Rating — which is the output of Tenable’s Predictive Prioritization capability — is re-calibrated each night as new information becomes available from Tenable’s global resources. Broadly speaking, Predictive Prioritization and the Vulnerability Priority Rating is shown to result in an approximately 97 percent reduction in the number vulnerabilities requiring immediate remediation. This leaves vulnerability management teams with a clear view of the remaining 3 percent of all known vulnerabilities most likely to be exploited in attacks.

Learn more:

• Read the blog: What You Need to Know About Vulnerability Management Best Practices
• Download the report: Measuring and Managing the Cyber Risks to Business Operations
• Watch the webinar: Leveraging the Power of Data Science for Prioritization

In part five of our six-part blog series, we explore the challenges facing organizations as they try to accurately answer the question: “How do we compare to our peers?” Here’s what you need to know.

Achieving visibility into your organization’s attack surface is the fundamental first step to building a mature cybersecurity strategy. Once you’ve laid a strong foundation for your Cyber Exposure efforts, the next step is developing an understanding of how your strategy compares to other organizations in your industry. 

The discipline of Cyber Exposure depends on your ability to accurately answer four key questions: 

1. Where are we exposed? 
2. How should we prioritize based on risk?
3. How are we reducing our exposure over time?
4. How do we compare to our peers?

Answering the last of these essential questions involves determining your company’s ranking amongst its peers in a competitive assessment of your defenses. Knowing where your company stands within your industry sector is crucial to developing an accurate understanding of the real-world potential for any threat to affect your operations.

For example, let’s say news breaks of a major headline vulnerability like Meltdown and Spectre. When your C-level executives are looking for answers about how your organization might be affected, knowing whether your company is easy prey or an impenetrable fortress compared to others will enable you to assess your real-world risk. 

That’s not the only reason to keep up with your peers. Having data about the Cyber Exposure status of others in your industry also helps you evaluate your past spends on cybersecurity and validate your future investments. A no-nonsense, no guesswork, data-driven approach can help you eliminate waste, fortify weak areas of your strategy and address any C-level resistance to your cybersecurity budget requests.

Achieving Industry-wide Cyber Exposure Benchmarks

Achieving an accurate picture of how your Cyber Exposure strategy stacks up against that of your peers is easier said than done, however. It requires the following:

• Industry data which is aggregated and anonymized to prevent re-identification in reverse engineering attempts. 
• Massive amounts of high quality data, drawn from thousands of organizations, in order to achieve reliable industry benchmarks
• Advanced risk-based Cyber Exposure scoring, so you can weigh vulnerabilities, threat data and each asset’s business value and criticality.

Access to this level of detail gives you the guidance you need to optimize your security processes 
and investments within the right business context. Indeed, context is everything in making solid security assessments. If a comparative ranking with industry peers finds you in the bottom quartile, you probably need to commit more budget and resources to come up to industry standard and achieve average protections. If your company ranks in the top quartile, you may not need to increase your budget and resources as much as you may have thought. 

Ultimately, your decisions should be based on data which allows you to:

• Visualize. The ability to see the entirety of your modern attack surface — including your IT and operational technology (OT) infrastructure — allows anyone, from analyst to executive, to quickly understand which threats you’re facing.
• Analyze. Advanced analysis and risk-based exposure scoring allows you to weighs vulnerabilities, threats, asset value and location, enabling you to prioritize the vulnerabilities you need to focus on first.
• Measure. The ability to benchmark and compare your efforts against other organizations enables you to optimize your security processes 
and investments.

We recognize that every organization is at its own level of maturity in its Cyber Exposure journey. In fact, the Tenable Research report Cyber Defender Strategies: What Your Vulnerability Assessment Practices Reveal shows that only 5 percent of enterprises follow the most mature, Diligent style of vulnerability management, while another 43 percent are practicing the Investigative style, which indicates a medium to high level of maturity. The majority (52 percent) of the 2,100 organizations studied for the report fall into mid- to low-maturity styles. This suggests most folks are still working on getting the basics right. Ultimately, though, the ability to present a full and accurate picture of the threat landscape for business stakeholders requires the right data.

Indeed, in a panel discussion about headline vulnerabilities at Tenable’s Edge 2019 user conference in May, Ramin Lamei, VP of Cloud Delivery for Global Payments, noted: “The job of a security practitioner is to make sure we’re arming our CISO with the right information, the right metrics where he can really be external-facing with the C-suite and his peers to continue really messaging the value or the importance of security and risk. If you’re not already very mature with your metrics and the way you report, and having the lateral process within the IT teams and other organizations, I think it’s critical. It’s a constant message that we have to continue to feed up to make sure the information is accurate and communicated at all levels...reiterating the risk and the challenges that we could face.”

Without the context made possible through industry benchmarking, you’re only telling part of the story. Achieving accurate benchmarking against your peers requires a living, breathing scoring system — one that evolves along with the threats that are out there — with data aggregated from a wide range of sources, including:

• The age of the vulnerability
• Exploit kit availability
• Chatter on the Dark Web
• Past threat patterns (e.g., evidence of exploitation in the past - how recent? how frequent?)
• Past threat sources (e.g., specific sources showing evidence of exploitation)
• Vulnerability metrics (CVSS metrics such as access vector, attack complexity, base score, etc)
• Vulnerability metadata (age of vulnerability, CVE, vendor/software impacted by the vulnerability, etc)
• Exploit availability using threat intelligence data (is the vulnerability on Exploit Database? Metasploit?

Tenable is committed to helping its customers achieve a comprehensive, data-driven approach to Cyber Exposure by offering tools such as Predictive Prioritization, the Vulnerability Priority Rating and Lumin.  

In part one of our six-part blog series on improving your cybersecurity strategy, we explored 4 Cybersecurity Questions Every CISO Should Be Ready to Answer. In part two, we covered 3 Tips for Identifying Your Organization’s Cyber Exposure Gap. In part three, we offered 5 Tips for Prioritizing Vulnerabilities Based on Risk. In part four, we explored Metrics and Maturity: Benchmarking Your Cyber Exposure Over Time. In part six, we’ll recap our top tips and provide additional guidance you can use at any point in your Cyber Exposure journey. 

Tenable Research has discovered a critical vulnerability in Siemens TIA Portal (also referenced as STEP 7) that would allow an attacker to perform administrative actions. Siemens has released an update and security advisory.

• What you need to know: Tenable Research has disclosed an unauthenticated RCE in Siemens SIMATIC STEP 7 V15.1.
• What’s the attack vector? Authentication bypass in the TIA Administrator server through websockets on the node.js server.
• What’s the business impact? Attackers could perform any administrative actions on the TIA Portal, including elevating privileges or sending malicious firmware updates.
• What’s the solution? Siemens has released an update and security advisory for this vulnerability.

Background

Siemens has released an update and security advisory for CVE-2019-10915, an unauthenticated remote command execution (RCE) vulnerability in the TIA Portal (also referenced as STEP 7) discovered by Tenable Researcher Joseph Bingham.

SIMATIC STEP 7 Professional V15.1 is the programming software for the controller families S7-300, S7-400, C7 and WinAC. According to Siemens, the software is used for automation tasks like “configuring hardware, establishing communications, programming, testing, commissioning and service, documentation and archiving, or operational and/or diagnostic functions.” It is deployed in sectors including manufacturing, utilities and transportation. 

Analysis

The vulnerability is an authentication bypass in the TIA Administrator server. An attacker could execute arbitrary application commands through websockets on the node.js server which is externally exposed by default.

By exploiting this vulnerability, an unauthenticated remote attacker could perform actions on TIA Portal, such as elevating privileges, changing proxy settings, or specifying malicious firmware updates. This vulnerability could be a critical part of a tailored attack against operational technology (OT) or industrial control systems (ICS), similar to Triton, Duqu and Stuxnet. Bingham explains how this vulnerability could be leveraged in an attack like this in his Medium blog post.

Business impact

An attacker could compromise a TIA Portal system and use their access to add malicious code to adjacent industrial control systems. Attackers could also use the access gained through exploitation of this vulnerability to steal sensitive data on existing OT setups to further progress and plan targeted attacks on critical infrastructure.

In a worst case scenario, a vulnerable TIA Portal system can be used as a stepping stone in an attack causing catastrophic damage to OT equipment, disrupting critical operations or conducting cyber espionage campaigns.

Solution

Users should confirm that they have updated to the latest version of Siemens STEP 7.

Additional information

• Visit the Tenable Tech Blog on Medium to read researcher Joseph Binghams’s in-depth story about the team’s work researching ICS security.
• Siemens STEP 7 Support Page
• Tenable Advisory

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io.

Microsoft’s July 2019 Security Updates were released on July 9, with nearly 80 vulnerabilities patched in this update, 15 of which are critical.

CVE-2019-0865 | SymCrypt Denial of Service Vulnerability

A denial of service vulnerability was identified in SymCrypt, the cryptographic library used to handle cryptographic functions on Windows. Using a specially crafted digital signature, an attacker could exploit this flaw by embedding the signature in a message or as part of a secure connection request. This vulnerability was publicly disclosed in June by Google Project Zero researcher Tavis Ormandy.

CVE-2019-0785 | Windows DHCP Server Remote Code Execution Vulnerability

A memory corruption vulnerability in the Windows Server Dynamic Host Configuration Protocol (DHCP) service could allow a remote malicious attacker to run arbitrary code on a DHCP failover server, or perform a denial of service (DoS) attack. An attacker would need to send a malicious DHCP request to the DHCP server, but the server must be set to failover mode.

CVE-2019-1132 | Win32k Elevation of Privilege Vulnerability

An elevation of privilege vulnerability that enables improper handling of objects in memory by a Win32k component could result in arbitrary code execution in kernel mode, which is typically reserved for trusted functions of the operating system. An attacker would first need to establish a presence on a target system in order to exploit this vulnerability and gain elevated privileges.

CVE-2019-1102 | GDI+ Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

CVE-2019-0880 | Microsoft splwow64 Elevation of Privilege Vulnerability

An elevation of privilege vulnerability identified in splwow64.exe could be combined with a remote code execution or a separate elevation of privilege vulnerability to gain arbitrary code execution. Because it was exploited in the wild, it is likely that it was paired with another vulnerability, but those details are not currently available.

CVE-2019-0887 | Remote Desktop Services Remote Code Execution Vulnerability

A remote code execution vulnerability was identified in Remote Desktop Services. Exploitation of this vulnerability could result in arbitrary code execution, but requires an attacker to have already compromised a target system. This vulnerability was first published in a blog on Reverse RDP attacks in February 2019 which included one CVE that did not receive a CVE-ID.

CVE-2019-1130 | Windows Elevation of Privilege Vulnerability

An elevation of privilege vulnerability in Windows AppX Deployment Service (AppXSVC) due to improper handling of hard links. This patch follows CVE-2019-1064, another elevation of privilege vulnerability in AppXSVC that was publicly disclosed by researcher SandboxEscaper as a bypass of CVE-2019-0841 and addressed in the June 2019 Patch Tuesday release. CVE-2019-1130 is credited to Polar Bear, which is a reference to SandboxEscaper. 

Tenable Solutions

Users can create scans that focus specifically on our Patch Tuesday plugins. From a new advanced scan, in the plugins tab, set an advanced filter for Plugin Name Contains July 2019.

With that filter set, click on the plugin families to the left, and enable each plugin that appears on the right side. Note that if your families on the left say Enabled then that means all of the plugins in that family are set. Disable the whole family before selecting the individual plugins for this scan. Here’s an example from Tenable.io:

A list of all of the plugins released for Tenable’s July 2019 Patch Tuesday update can be found here.

Learn more:

• Microsoft’s July 2019 Security Updates
• Tenable plugins for Microsoft July 2019 Patch Tuesday Security Updates

Learn how practicing the basics of web application security and keeping up with the threat landscape can help keep your business secure.

When it comes to threat actors breaking into corporate networks and stealing data, most attacks start with relatively well-known vulnerabilities in web applications — the same ones corporations use to interact with their customers and the public at large.

“Web applications are still the top attack vector in terms of creating or causing data breaches,” said Nate Dyer, a senior product marketing manager at Tenable. And while web application security remains a major issue for enterprises, a few basic preventative measures can keep sensitive business and customer data safe.

During the recent Tenable webinar, Protect Your Web Applications from Component Vulnerabilities, Dyer and Eric Detoisien, Director of Research for Web Application Scanning (WAS) Content, discussed how — by paying attention to vulnerabilities and the threat landscape — businesses of all sizes can help pare back some of the attacks that can lead to a data breach and the headlines that come with it.

Web Application Security Basics

While web application vulnerabilities are the top source for data breaches in the enterprise, specific industries are more susceptible than others. These include healthcare, retail and even some public sector and government agencies — basically any organization that deals in large amounts of personally identifiable information (PII), credit card numbers or other types of customer data attackers look for during a breach.

At the same time, web applications — even the most simple looking, static webpage — are fairly complex. There’s the underlying content management system (CMS) that most pages are built on. Then there are the libraries and frameworks used to build these apps. And, finally, there’s typically custom code developers create to add functionality and other features for the businesses using these sites.

Each of these layers presents its own level of risk to the business. For example, the custom-code layer within most web applications is vulnerable to any of the Open Web Application Security Project (OWASP) Top 10 issues, including injections, misconfigurations or cross-site scripting.

Meanwhile, third-party web application components create their own unique set of problems. As an example, Dyer and Detoisien discussed Apache Struts and the unpatched vulnerability that eventually led to the breach at Equifax, which affected nearly 150 million customers and resulted in executive shake-ups, federal investigations and Congressional hearings. The issues with various CMS platforms are also well documented. “It seems every month, there’s a new vulnerability or a new exploit associated with either WordPress or Drupal or Joomla,” Dyer said.

Given the trove of personal data potentially accessible via web applications, it’s no surprise that attackers will swarm to take advantage of a vulnerability. Once a vulnerability is discovered, threat actors use what Detoisien described as “spray and raid” tactics to hit as many apps as possible before patches are rolled out, giving them enough victims to make the hacking profitable.

Web Application Scanning: Consider your Components

Dyer and Detoisien discussed two main themes for security professionals to remember to help prevent attacks on web applications:

• Basic cyber hygiene will address many weaknesses. If your business is able to detect the vulnerability and your security team is able to prioritize the remediation based on the actual cyber risk, this is a hugely important way to help secure web applications, as well as other types of IT assets on the network.
• Keeping abreast of the latest vulnerabilities and patches can prevent a breach. Many of the most basic web application components, such as jQuery plugin, are widely used, and attackers take advantage of these components for their purposes, so it’s worth keeping up with the latest security alerts and updates from the major application providers.

Once you’ve got the basics down, Dyer and Detoisien recommend making sure you’re assessing all the external components comprising your web applications. These can include web app servers, a CMS, web frameworks, JavaScript libraries and language engines. This involves:

• identifying all the entry points within various web apps;
• fingerprinting all components within the app, which can help assess what versions of the components your business is running; and
• assessing the components for flaws, such as misconfigurations.

Practicing these tactics can take your web application security plan beyond looking at the OWASP Top 10, giving you a much fuller view not only of the apps your business is running, but the components that make up those applications. Armed with this level of detail, your security team can make smarter decisions when it comes to assessing risk and rolling out patches to address critical flaws and vulnerabilities.

Learn More:

• View the on-demand webinar: Protect Your Web Applications from Component Vulnerabilities 
• Download the eBook: 5 Best Practices for Web Application Security
• Read the 2018 Application Security Report

A zero-day vulnerability in Zoom could potentially lead to a remote code execution attack. Here’s what you need to know.

Background

Security researcher Jonathan Leitschuh has disclosed a zero day in the Zoom client for Mac, that allows an attacker to force a user to join a Zoom call with their webcam enabled. The disclosure blog also suggests this could potentially lead to a remote code execution attack (RCE), which may have been found by other researchers as well but remains undisclosed and unconfirmed. According to the research, a web server running on port 19421 is present if the Zoom client on Mac has ever been installed.

This Zoom vulnerability is bananas. I tried one of the proof of concept links and got connected to three other randos also freaking out about it in real time. https://t.co/w7JKHk8nZypic.twitter.com/arOE6DbQaf

— Matt Haughey (@mathowie) July 9, 2019

Analysis

Malicious HTTP requests can be sent to the web server installed alongside the Zoom Mac client that launches a video call with the attacker, with the affected user’s webcam enabled. These requests cannot override user configuration though, so if a user has disabled the automatic webcam, they may still be joined to a call, but their webcam will not be enabled. The researcher also mentions CVE-2018-15715, a Zoom message spoofing flaw discovered by Tenable researcher David Wells, which could be used in conjunction with CVE-2019-13450 to execute an RCE attack.

Proof of concept

The advisory blog provides the following lines of code that an attacker could embed in their site to initiate a call with a vulnerable user:

And the following line enables the webcam for users with automatic video turned on:

Vendor response

Zoom has responded to the disclosure with additional information on how it’s going to improve the user experience to alleviate concerns in the future. Zoom also noted that the Denial of Service (DoS) vulnerability reported by the researcher (CVE-2019-13449) was fixed in May 2019 (Client version 4.4.2).

Solution

Zoom has released an update for the Mac client (4.4.53932.0709) that removes the web server and allows users to fully uninstall Zoom from the client. That update can be applied from the Zoom client or downloaded manually here. Zoom has also stated that it plans to provide further updates over the course of the coming weekend (July 12).

Users can disable automatic video in Zoom, which can be found here in your user settings:

Image Source: Jonathan Leitschuh

Identifying affected systems

A list of Nessus plugins to identify this vulnerability will appear here as they’re released.

Get more information

• Disclosure advisory
• Response from Zoom
• CVE-2019-13450: Zoom Vulnerability Discovered by Tenable Research

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io.

Tenable Research has discovered multiple critical vulnerabilities in both Citrix SD-WAN Center and the SD-WAN appliance itself that could allow a remote, unauthenticated attacker to compromise the underlying operating systems of each.

• What you need to know: Tenable Research has disclosed four unauthenticated command injections, an unauthenticated directory traversal and one authenticated command injection in Citrix SD-WAN Center. Tenable Research has also disclosed an unauthenticated SQL injection vulnerability and an authenticated command injection vulnerability which can be used in a chained attack to achieve unauthenticated remote command execution.
• What’s the attack vector? In the SD-WAN Center, multiple remote code execution (RCE) vulnerabilities can be exploited without authentication to gain root access. In the SD-WAN appliance, an unauthenticated SQL injection can be used to bypass authentication. When combined with an authenticated command injection, an attacker can achieve unauthenticated RCE.
• What’s the business impact? An attacker could compromise the underlying operating system (OS) of the Citrix SD-WAN Center. The attacker could also exploit some of these vulnerabilities to traverse the target wide-area network (WAN).
• What’s the solution? Citrix has released patches to address the reported vulnerabilities.

Background

On July 2, Citrix released SD-WAN version 10.2.3 to address multiple vulnerabilities found in Citrix SD-WAN Center and SD-WAN appliance. Tenable has released two research advisories [1, 2] to cover the scope of these vulnerabilities. The first of these advisories includes multiple RCE vulnerabilities found in Citrix SD-WAN Center, while the second includes two vulnerabilities which can be combined to achieve unauthenticated RCE in an SD-WAN appliance. (SD-WAN is both the name of the Citrix product line and a generic term to describe any software-defined wide area network.) These vulnerabilities were discovered by Tenable Researcher Chris Lyne.

Wide area networks are increasingly being managed using software-defined technologies such as Citrix SD-WAN (and others). Adoption of the cloud has created a slew of new challenges for IT management and security as organizations host applications and infrastructure in multiple locations (on-prem, private cloud, public cloud). Many organizations are adopting SD-WAN technology to address the challenges created in today’s complex IT world.

According to a report by CTC Technologies, Citrix SD-WAN ranks in the top 5 SD-WAN vendors for 2019. Citrix SD-WAN Center is a management system which allows enterprises to oversee all SD-WAN appliances on their WAN. According to its customer stories page, Citrix has many notable customers worldwide and across multiple industries.

Analysis

Tenable discovered multiple critical vulnerabilities (CVSSv2 10.0 Base Score) in SD-WAN Center. These vulnerabilities can be exploited by a remote, unauthenticated attacker to gain root privileges on the OS. Technically speaking, the vulnerabilities are made up of several command injections and a directory traversal in the SD-WAN Center web application. These vulnerabilities can be exploited by a novice attacker.

Tenable has also discovered multiple vulnerabilities in the SD-WAN appliance. These vulnerabilities can also be exploited by a remote, unauthenticated attacker to gain root privileges on the OS.

Citrix has assigned the following CVEs for the six vulnerabilities in Citrix SD-WAN Center:

• CVE-2019-12985: Unauthenticated Command Injection
• CVE-2019-12986: Unauthenticated Command Injection
• CVE-2019-12987: Unauthenticated Command Injection
• CVE-2019-12988: Unauthenticated Command Injection
• CVE-2019-12990: Unauthenticated Directory Traversal File Write
• CVE-2019-12992: Authenticated Command Injection

The vulnerabilities in the Citrix SD-WAN Appliance received the following CVEs:

• CVE-2019-12989: Unauthenticated SQL Injection
• CVE-2019-12991: Authenticated Command Injection

Proof of concept

Business impact

Given that organizations would use Citrix SD-WAN to manage their networks across geographical regions, the damage potential is extremely high. An attacker is able to not only compromise the underlying OS of Citrix SD-WAN Center, but also gain administrative access to the application itself. This is true for the SD-WAN appliance as well.

The only requirement is that the attacker must be able to reach an instance of either SD-WAN or SD-WAN Center. This requirement would be determined by how the instance is positioned in a network topology. Consequently, the threat actor could range from an insider threat to an external attacker. The likely threat actor profile would depend on the nature of the organization.

If a successful attack were mounted, it could be devastating to any organization. An attacker would have access to all of the SD-WAN Center application’s functionality. This level of access means an attacker could bring down a specific branch location’s connectivity or even an entire WAN. An attacker could also launch a more fine-tuned attack and make specific configuration changes to the SD-WAN. They could also use these vulnerabilities to traverse from appliance to appliance at will.

Solution

Citrix has released a security advisory and patches to address the reported vulnerabilities.

Additional information

• Visit the Tenable Tech Blog on Medium to read researcher Chris Lyne’s in-depth story about his work uncovering these vulnerabilities.
• Citrix SD-WAN Download page (restricted access)
• Tenable Advisory: Citrix SD-WAN Center Multiple Vulnerabilities
• Tenable Advisory: Citrix SD-WAN Appliance Multiple Vulnerabilities

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io.

Vulnerability introduced nearly eight years ago could lead to remote code execution on vulnerable Jira Server and Data Center systems.

Background

On July 10, Atlassian published Security Advisory 2019-07-10 to address a critical vulnerability in Jira Server and Jira Data Center. Jira Server manages and controls Atlassian’s Jira ticketing system, while Jira Data Center allows administrators to manage business-wide management and scalability of Jira Servers.

Analysis

CVE-2019-11581 is a server-side template injection vulnerability in “various resources” of Jira Server and Data Center. According to the advisory, the vulnerability was introduced in version 4.4.0, which was released in August 2011, making this vulnerability nearly eight years old.

The template injection vulnerability exists within the ContactAdministrators and SendBulkMail actions in Jira Server and Data Center. However, in order to exploit the vulnerability, an SMTP server needs to be configured, and either the Contact Administrators Form needs to be enabled (unauthenticated attack), or the attacker has “JIRA Administrators” access (authenticated attack). Exploitation of this vulnerability would grant an attacker the ability to remotely execute code on the vulnerable Jira system.

Proof of concept

At the time of publishing, there was no proof of concept (PoC) available. However, similar to what transpired following the Atlassian advisory for the Confluence Widget Connector vulnerabilities (CVE-2019-3395, CVE-2019-3396) in March 2019, we anticipate that PoCs will emerge in the near future.

Solution

As noted in the Analysis section, CVE-2019-11581 was introduced in Jira Server and Data Center version 4.4.0. The patched versions that address this vulnerability include 8.0.3, 8.1.2, 8.2.3 and Enterprise releases 7.6.14 and 7.13.5. The following table lists the vulnerable versions and associated fixed versions.

Atlassian also advises that customers who have installed Jira Service Desk version 3.0.0 before 4.2.3 may also be affected by this vulnerability. They have provided a compatibility matrix to help identify whether or not the Jira Service Desk version is affected.

Atlassian also notes that Jira Cloud customers are not affected by this vulnerability.

If upgrading to a patched version of Jira Server or Data Center is not currently feasible, Atlassian recommends the following temporary workarounds:

• First, disable the Contact Administrators Form
• Second, block access to the /secure/admin/SendBulkMail!default.jspa endpoint

Identifying affected systems

A list of Tenable plugins to identify this vulnerability will appear here as they’re released.

Additionally, Atlassian has provided a support document to help identify if an attacker has compromised a Jira instance using CVE-2019-11851.

Get more information

• JIRA Security Advisory 2019-07-10

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 60-day trial of Tenable.io.

Tenable’s six-part blog series explores the challenges involved in achieving a holistic cybersecurity strategy and provides tips and advice for advancing the discipline of Cyber Exposure in your enterprise.

Piecemeal approaches to cybersecurity result in gaps and overlaps which, in turn, lead to unexpected vulnerabilities and unintended redundancies in budget and resource spend. This leaves your team with alert fatigue and stuck in a rut of tackling threats as separate tasks. 

A holistic Cyber Exposure strategy, by contrast, eradicates the gaps and overlaps and focuses the team and resources on vulnerabilities across the entire attack surface. Cyber Exposure is an emerging discipline for managing and measuring cybersecurity risk in the digital era. Cyber Exposure enables organizations to manage and measure the modern attack surface to accurately understand and reduce their cyber risk. Cyber Exposure translates raw vulnerability data into business insights to help security teams prioritize and focus remediation based on business risk. Cyber Exposure provides executives and boards of directors with a way to objectively measure cyber risk to help guide strategic decision making.

Just as other functions have a system of record — including ITSM for IT and CRM for Sales — Cyber Exposure solutions provide security professionals with a system of record to help them effectively manage and measure cyber risk.

4 Cybersecurity Questions Every CISO Should Be Ready to Answer

Building a holistic cybersecurity strategy using the discipline of Cyber Exposure enables you to answer each of these four questions about your organization at any point in time:

1. Where are we exposed? 
2. How should we prioritize based on risk? 
3. How are we reducing exposure over time? 
4. How do we compare to our peers? 

Learn more about how to prepare your organization to readily answer these four key Cyber Exposure questions here. 

3 Tips for Identifying Your Organization’s Cyber Exposure Gap

“Where are we exposed?” is the first of the four key Cyber Exposure questions — and the most crucial question to answer. Vulnerabilities are often hidden and hard to find.

Networks are continuously expanding in terms of numbers and types of internet-connected devices. The challenges in securing and monitoring the entire network are also growing at unprecedented speed. 

Internet of Things (IoT) devices are not the only hidden corners that provide opportunities for attackers. Cloud services and cloud environments, containers, industrial control devices, points of sale, HVAC, and anything not typically handled by the IT/SecOps teams contain significant openings for increasingly sophisticated threats to exploit. Getting — and maintaining — a handle on where the highest risks lie is necessary to protecting your company’s brand and assets.

Learn more about how to answer the critical Cyber Exposure question “where are we exposed?” here.

5 Tips for Prioritizing Vulnerabilities Based on Risk

Once you’ve gained an accurate view of your entire attack surface, it’s time to consider how to prioritize your vulnerability response strategy. Since no two organizations are alike, this requires understanding the level of business threat each vulnerability poses to the critical assets in your particular organization.

At a time when organizations of all sizes are challenged to keep their cybersecurity teams adequately staffed, being able to prioritize your vulnerability response tactics is more essential than ever. According to the report Measuring and Managing the Business Costs of Cyber Risk, conducted by Ponemon Institute on behalf of Tenable, the majority of organizations say the security function does not have adequate staffing to scan vulnerabilities in a timely manner. Without effective response prioritization, how can you know where to invest limited resources and personnel to protect your organization’s most critical assets?

Learn more about how to answer the critical Cyber Exposure question “how should we prioritize based on risk?” here.

Metrics and Maturity: Benchmarking Your Cyber Exposure Over Time

Once you understand the entirety of your attack surface, the next challenge is to develop a granular understanding of where your most business-critical assets are housed so you can begin to measure your progress in keeping them safe. This means comparing analytical outputs by business unit, geography and asset types.

Only then can you begin to benchmark your performance by creating a Cyber Exposure score. Benchmarking starts with raw numbers, such as how many vulnerabilities you have this year compared with last year, or how significant those vulnerabilities are to your organization. But it’s much more than that. It’s also about process maturity, such as how long it takes your organization to remediate critical vulnerabilities this year versus last year, and how effectively you’re responding to new vulnerabilities year over year. 

Learn more about how to answer the critical Cyber Exposure question “how are we reducing our exposure over time?” here.

How Do Your Cyber Exposure Practices Stack Up to Those of Your Peers?

Answering the last of these essential questions involves determining your company’s ranking amongst its peers in a competitive assessment of your defenses. Knowing where your company stands within your industry sector is crucial to developing an accurate understanding of the real-world potential for any threat to affect your operations.

Without the context made possible through industry benchmarking, you’re only telling part of the story. Achieving accurate benchmarking against your peers requires a living, breathing scoring system — one that evolves along with the threats that are out there — with data aggregated from a wide range of sources.

Learn more about how to answer the critical Cyber Exposure question “how do we compare to our peers?” here.

Learn more

Read the complete Cyber Exposure blog series:

• 4 Cybersecurity Questions Every CISO Should Be Ready to Answer
• 3 Tips for Identifying Your Organization’s Cyber Exposure Gap
• 5 Tips for Prioritizing Vulnerabilities Based on Risk
• Metrics and Maturity: Benchmarking Your Cyber Exposure Over Time
• How Do Your Cyber Exposure Practices Stack Up to Those of Your Peers?
• Cyber Exposure: Taking a Holistic Approach to Vulnerability Management

A proof-of-concept for critical Atlassian Crowd vulnerability patched on May 22 is now available.

Background

On July 14, security researcher Corben Leo published a blog detailing the analysis of a recently patched vulnerability in Atlassian Crowd, a user management application for access control for Active Directory (AD), Lightweight Directory Access Protocol (LDAP), OpenLDAP and Microsoft Azure AD.

Analysis

On May 22, Atlassian published Crowd Security Advisory 2019-05-22 to address CVE-2019-11580. According to the advisory, Crowd and Crowd Data Center incorrectly enabled a development plugin for pdkinstall in release builds. A remote attacker could exploit this flaw to install arbitrary plugins by sending unauthenticated or authenticated requests to vulnerable Crowd or Crowd Data Center instances, which could grant them the ability to execute code.

Leo’s blog post provides analysis of the pdkinstall plugin and the PdkInstallFilter servlet, which he used to craft a proof-of-concept (PoC) that allowed him to gain pre-authenticated remote code execution in Atlassian Crowd.

Image credit: Corben Leo

Proof of concept

Leo published a malicious plugin on GitHub to be used as part of a PoC included in his blog post:

curl -k -H "Content-Type: multipart/mixed" \ --form "file_cdl=@rce.jar" http://localhost:4990/crowd/admin/uploadplugin.action

Solution

Atlassian published patched versions of Crowd and Crowd Data Center on May 22. The patched versions include 3.0.5, 3.1.6, 3.2.8, 3.3.5, and 3.4.4. The following table lists the vulnerable versions and the associated fixed versions.

If upgrading to a patched version of Atlassian Crowd is not feasible at this time, Atlassian provided mitigation steps in their Security Advisory to address the vulnerability as well as a bash script to automate the mitigation steps on Linux systems.

Identifying affected systems

A list of Tenable plugins to identify this vulnerability can be found here.

Get more information 

• Crowd Security Advisory 2019-05-22
• Analysis of an Atlassian Crowd RCE - CVE-2019-11580

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io Vulnerability Management.

Recasting cybersecurity as another essential public service, just like safety or water or electricity, can help local government leaders make the case for cybersecurity funding. Here’s how. 

There is a unique and often overlooked inverse relationship between the size of public sector government entities and the impact they have on the residents who make use of public services. This relationship creates a disproportionate burden on local governments, which may be small in size but have a large potential impact on the daily lives of their constituents. 

It is most often the local governments that are responsible for the delivery of essential services such as public safety communications, power generation and distribution, water treatment and waste removal. And, when such critical infrastructure is compromised by a cybersecurity event, such as a  ransomware attack, the lives of local residents are upended. 

In effect, the expanding modern attack surface appears to create a disproportionately larger “affect” surface as the size of the jurisdiction gets smaller. 

Cyber criminals don’t discriminate based on size when attacking government entities: any jurisdiction is fair game, from the largest federal agency down to the smallest city government. Because cybersecurity funding is very limited in local government, county and city officials should consider ways to increase public awareness of the need for increased investment in cybersecurity by tying it to existing public services that are fully supported and admired by constituents and to campaigns that will garner broad public support, such as reducing the “digital divide.”

3 Ways Local Governments Can Change the Cybersecurity Conversation

Here are three ideas for how local governments can change the dialog around cybersecurity to help constituents understand the importance of investing precious public resources in such efforts:

1. Include cybersecurity as a key element of public safety. The cybersecurity budget line item in state government is less than 3 percent of the total IT budget, according to a 2018 study by the National Association of State Chief Information Officers (NASCIO); anecdotally, we hear that the local cybersecurity budget is often even less. Public safety is a much larger component of local budgets, in part because the public can see where their tax dollars are going in the form of more police officers and firefighters. Yet, cybersecurity is essential to keeping increasingtly internet-facing critical infrastructure safe and secure. It is a true statement that “cyber tools don’t rescue cats from trees,” so it is unlikely that they will ever be valued as highly by local taxpayers. But what if we spoke of cybersecurity in the language of public safety? For example, framing predictive prioritization of cyber vulnerabilities as an essential public safety measure — much like local governments justify the spending on tools like CompStat for law enforcement or SeeClickFix systems for community alerts — would demonstrate that public funds are being used as efficiently as those used to address violent crime and quality-of-life needs. 
2. Make cybersecurity a community campaign. If public services go down then everybody suffers, especially the most vulnerable in society. Homebound seniors may see interruption in their remote medical devices if power is lost. Low-income residents may not be able to get to work if public transportation is interrupted. And a loss of public safety communications, such as 911 service, can lead to loss of life. All of these scenarios are acutely felt at the local level and will certainly affect a large segment of the population. Avoiding these interruptions is thus a community responsibility and can be used as justification to rally support for public campaigns to improve cyber hygiene and increase awareness of cyber threats. 
3. Utilize cybersecurity curriculum in K-12 education in to shrink the digital divide. Internet of Things (IoT) and web-based applications to streamline service delivery are showing great promise but they also have the potential to widen the digital divide. Cities are making broadband access available to larger segments of residents but it may not be utilized equally by all. Promoting cybersecurity skills and tools in K-12 education can help close this divide by making cyber careers more accessible to a larger swath of the community, breaking down barriers of entry to IT careers and affecting multiple generations, as students instruct their parents and other family members on the importance of cybersecurity and the value of digital transformation.  

Helping residents understand the link between cybersecurity and the most basic public services is an important step in making the case for increased funding. These three ideas are one way for officials to begin the conversation and raise awareness of the importance of keeping critical infrastructure safe and secure.

Learn More 

• Read about Tenable’s Predictive Prioritization offerings.
• View the on-demand webinar Cybersecurity in Public Sector: 5 Insights You Need to Know.
• Read about Tenable’s Operational Technology solutions.  

Oracle fixes 265 vulnerabilities in July’s Critical Patch Update.

Background

On July 16, Oracle released its Critical Patch Update (CPU) for July 2019 as part of its quarterly release of fixes for vulnerabilities. This update contains fixes for 265 CVEs, according to the Oracle Advisory to CVE Map, across several Oracle products.

Analysis

Oracle’s July 2019 CPU contains 265 addressed CVEs across 25 products, and many of those vulnerabilities have a critical CVSS rating of 9.8. These critical vulnerabilities are unauthenticated remote code execution (RCE) vulnerabilities that could lead to full application takeover when exploited. Oracle's Risk Matrix page has full descriptions for all the patched vulnerabilities in this update.

This CPU also contains fixes for CVE-2019-2725 and CVE-2019-2729, which Tenable covered CVE-2019-2725 back in April and CVE-2019-2729 in June.

Solution

Customers are advised to apply all relevant patches provided by Oracle in this CPU. Please refer to the July 2019 advisory for full details.

Identifying affected systems

A list of Nessus plugins to identify these vulnerabilities will appear here as they’re released.

Get more information 

• Oracle Critical Patch Update Advisory - July 2019
• Oracle Advisory to CVE Map
• July 2019 CPU Risk Matrix Page

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io Vulnerability Management.

Learn why Tenable.sc and Tenable.io, both with Predictive Prioritization, are Sentara Healthcare’s choices for vulnerability management. 

Sentara Healthcare, the largest health system in the state of Virginia, is a complex technology environment with a mix of IT and operational technology assets and a user base that includes clinicians, administrators, third-party vendors and patients. And the environment is changing rapidly, as healthcare organizations like Sentara realize the value of digital transformation. 

“The model is changing,” said Sentara CISO Dan Bowden in an interview during Tenable’s Edge 2019 user conference in Atlanta in May. “We see a future where at least half of our encounters with our patients will be of a digital nature. Meaning now, the threat surface and Cyber Exposure surface just changed drastically.”

And the organization’s exposure is not limited to the computing devices and applications used throughout the organization — it also includes the supervisory control and data access (SCADA) systems supporting the organization’s operational technology (OT) infrastructure, which includes HVAC, refrigeration and entry systems. “If someone shuts down our HVAC systems due to some kind of a cyber attack, that could affect [the quality of] patient care and cause a lot of disruption to how we do business,” said Bowden.

Given the high volume of potential vulnerabilities the organization faces on a daily basis, knowing which to patch first is a key challenge. “Being able to prioritize what we work on in terms of vulnerabilities and threats is crucial,” says Bowden. “There's this constant churn of awareness and stress over deciding ‘well, what do we patch first?’ ” 

Putting Predictive Prioritization to Work

The organization uses Tenable.sc on premises and Tenable.io in the cloud for vulnerability management and has been putting the new Predictive Prioritization capabilities to use in identifying which bugs to address first.

Predictive Prioritization, introduced in February 2019, combines Tenable-collected vulnerability data with third-party vulnerability and threat intelligence and analyzes them together using an advanced data science algorithm developed by Tenable Research. The data analysis is used to develop a Vulnerability Priority Rating (VPR) for each vulnerability. 

“Predictive Prioritization can help you understand, ok, of all those ‘critical’ vulnerabilities, maybe 80 percent have never been exploited and there's no discussion about those out on the Dark Web or through threat intel sources,” said Bowden. 

Having more context about the real-world threat potential of each vulnerability improves the level of communication between Bowden’s security team and their IT colleagues who are responsible for patching. “We can't dump [a] list of 10,000 [vulnerabilities] on the IT team and expect them to engage with us,” said Bowden. “If I give them a list of a couple hundred? […] They'll engage. They'll help us. The application teams will help us. The benefit of Predictive Prioritization is, it sets the context of a discussion, where people actually want to be part of that story of how risk got managed and vulnerabilities were addressed.”

The benchmarking data available from Predictive Prioritization and the VPR score also gives Bowden the data points he needs to communicate with C-level executives, the board and business-side colleagues about the potential impact of cybersecurity threats. “A benchmark is worth a thousand words,” said Bowden. “It gives some clarity to the discussion [...] the security team [...] can feel comfortable that they gave good data, that it was understood because [they] spoke it in the language that the leaders of the organization understand and they help own the message, and I think, then, [they] also help own the accountability for the security program.”

Even in an organization like Sentara, where Bowden said the leadership is highly supportive of cybersecurity efforts, the context and clarity provided by Tenable’s tools helps ease communication between infosec and business stakeholders. “if I just show them ‘hey, we've got all these thousands of critical vulnerabilities and all of it's important,’ they don't know my job at a detailed enough level to know how to help me, even though they want to,” he explained. “In the climate today, there's so much focus from society about companies doing better managing risk, every leadership team and every board in every organization wants to be part of the story of fixing the problem. If you can give them good data about exposure, which things do we really need to do, they understand the data, they can relate to the data. They want to be part of the story to help you solve the problem and manage risk better.”

Watch Now

Tenable interviews Dan Bowden, CISO of Sentara Healthcare, at our Edge 2019 user conference:

Learn More

• Watch Dan Bowden discuss Sentara Healthcare's Cyber Exposure and Predictive Prioritization story in a keynote presentation at Tenable's Edge 2019 user conference here.
• Visit our Predictive Prioritization webpage here. 

In part one of our five-part series on Vulnerability Management fundamentals, we explore the four stages of the Cyber Exposure lifecycle. 

Truth is ever to be found in simplicity, and not in the multiplicity and confusion of things.

—Sir Isaac Newton

At Tenable, we are pioneering the discipline of Cyber Exposure to help cybersecurity teams measure and manage their cyber risk. Cyber Exposure is essential for communicating cyber risks to business stakeholders and ensuring cybersecurity is factored into strategic business decisions as a key input variable. 

Core to enabling Cyber Exposure is a robust vulnerability management (VM) program. In fact, Cyber Exposure cannot be effective without the basics of VM already in place. In today’s overcrowded world of security threats, shiny new tools and expanding regulations, it is easy to lose sight of the fundamentals of security: reducing cyber risk by identifying and remediating vulnerabilities in your most important assets. VM is a process of identifying and classifying all assets across your attack surface, assessing those assets for security weaknesses, prioritizing security issues for mitigation and applying the appropriate remediation measures. 

In fact, a closer look at the Cyber Exposure lifecycle reveals just how important VM is to Cyber Exposure. VM helps organizations discover, assess, analyze and fix exposures across the attack surface. In this five-part blog series we’ll look at the individual steps of this lifecycle to show how VM fundamentals can help you reduce cyber risk. Let’s start with an overview. 

1. Discover - asset discovery and classification 

As the age-old security adage goes, “you can’t protect what you can’t see.” Maintaining a comprehensive and continuously updated asset inventory is a fundamental and critical component of VM. With today’s complex IT environments spanning on-premises and cloud infrastructure, mobile devices, ephemeral and transitory assets, web applications, IoT devices, etc., maintaining a comprehensive asset inventory is anything but simple. It starts with comprehensive asset discovery and classification based on business impact and risk. Keep in mind, your infrastructure is ever-changing. So asset discovery and classification needs to be done on an ongoing basis.

Learn more: Attend our upcoming webinar, “How to Master the Fundamentals of Vulnerability Management Part 1: Asset Discovery and Classification,” 2pm ET, July 31, 2019, for practical advice on this topic.

2. Assess - comprehensive and continuous vulnerability assessment 

Once you have a comprehensive asset inventory, it is time to assess vulnerabilities on the assets, so you get a clear picture of your attack surface and risk. It is important to balance depth, breadth and frequency of vulnerability assessment, because it will be challenging to achieve all three on a consistent basis. Deep assessment, involving credentialed scans and agents, provides rich vulnerability data, but can take a lot of time and consume resources on the assets. Broad and frequent assessment can be also be limited by business operations. As with other security activities, you have to balance security and business needs and leverage process changes as well as tools to achieve your assessment goals. 

3. Analyze - vulnerability analysis and prioritization 

At this stage you will run into the classic challenge of all vulnerability management and security programs: data overload. Vulnerability assessment is likely to show you more critical and high severity vulnerabilities than you can act upon in a reasonable time frame. So how do you prioritize vulnerabilities for remediation? By focusing on the vulnerabilities and assets most likely to be exploited. Note: this does not mean you should ignore the rest of the vulnerabilities and assets, rather, you should prioritize based on business impact and risk.

4. Fix - vulnerability remediation and validation

Remediation of vulnerabilities and verification of results is the final step in the VM lifecycle. A lot of data breaches are caused by well-known vulnerabilities left unpatched for a long time. But as with other steps, patching comes with its own challenges. Getting accurate information on which patches to apply to achieve the maximum risk reduction is difficult. .As is identifying asset owners and nudging them to prioritize patching over other business activities. Patching is also time consuming and can result in downtime for some assets. You may have to leverage other security systems to protect assets while patching is in progress. Finally, you need to validate patching is successful and business risk has actually been reduced.

Remember, VM is an ongoing process. The vulnerability management lifecycle steps discussed in this blog must be continuously repeated for your Cyber Exposure practices to be effective.In subsequent blog posts, we will dig deeper into each step of VM lifecycle. Stay tuned. 

Researchers disclose a critical vulnerability in Palo Alto GlobalProtect SSL VPN solution used by many organizations.

Background

On July 17, researchers Orange Tsai and Meh Chang published a blog about their discovery of a pre-authentication remote code execution (RCE) vulnerability in the Palo Alto Networks (PAN) GlobalProtect Secure Socket Layer (SSL) virtual private network (VPN) used by many organizations around the world.

Analysis

CVE-2019-1579 is a format string vulnerability in the PAN SSL Gateway, which handles client/server SSL handshakes. More specifically, the vulnerability exists because the gateway passes the value of a particular parameter to snprintf in an unsanitized, and exploitable, fashion. An unauthenticated attacker could exploit the vulnerability by sending a specially crafted request to a vulnerable SSL VPN target in order to remotely execute code on the system.

Though the researchers reported their findings to PAN, the company responded that the vulnerability had been identified internally and fixed, hence why no CVE identifier was assigned and why newer versions of GlobalProtect are not vulnerable.

From there, the researchers sought to identify whether any large organizations might be running a vulnerable version of GlobalProtect. They found that popular ride-hailing service, Uber, was running an unpatched version. They confirmed their exploit worked against Uber and reported their findings. Uber responded it did not use PAN SSL VPN as its “primary VPN” and that it was hosted on Amazon Web Services (AWS) and not a part of the organization’s “core infrastructure,” which mitigated some of the potential impact of this vulnerability.

We expect to see more incoming scans to identify organizations running vulnerable instances of the PAN SSL VPN in their environments.

Proof of concept

Tsai and Chang included a proof-of-concept (PoC) in their blog post, but it requires modification in order to work successfully. They also provided a command to help identify vulnerable GlobalProtect versions based on the login.css file (8.x) and a .gif file (7.x).

Vendor response

Since publication of Tsai and Chang’s blog, PAN has assigned a CVE identifier, CVE-2019-1579, and published a security advisory, PAN-SA-2019-0020, for it.

Solution

The following table contains information about vulnerable versions and fixed or non-vulnerable versions of the PAN-OS:

This vulnerability does not impact PAN-OS 9.0.

Additionally, PAN-SA-2019-0020 provides mitigations for customers who cannot upgrade to a patched version. The company recommends updating to “content release 8173, or a later version” as well as ensuring threat prevention is “enabled and enforced on traffic that passes through the GlobalProtect portal and GlobalProtect Gateway interface.”

Identifying affected systems

A list of Nessus plugins to identify this vulnerability will appear here as they’re released.

Get more information

• Disclosure Blog from Orange Tsai and Meh Chang
• Palo Alto Security Advisory: PAN-SA-2019-0020
• Mitre: CVE-2019-1579

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 60-day trial of Tenable.io.

The IoT Standards Leadership Act would require the U.S. Department of Commerce to report on  U.S. engagement in international IoT standards-setting bodies and their effectiveness for cybersecurity. Here’s why it matters.

The modern attack surface is growing faster than ever before, enabled in large part by the explosion of mobile computers, smartphones and Internet of Things (IoT) devices like the weather monitoring systems on the electric grid and the sensors connected to industrial control systems to make factories and warehouses run smoothly. 

In fact, the Ericsson Internet of Things Forecast predicts there will be 18 billion IoT-related connected devices by 2022. While the exponential increase in IoT devices is enabling organizations to  improve services and efficiency, it also widens the Cyber Exposure gap for users and provides bad actors with easy access to unsecured devices. 

As the global use of IoT devices continues to grow, the U.S. has a responsibility to help develop strong IoT security standards. We must maintain leadership on this important issue, and that includes supporting international, multi-stakeholder standards development processes with respect to internet-connected devices.  These processes can help enable further innovation, while strengthening security.

Tenable supports the IoT Standards Leadership Act recently introduced by Representatives Doris Matsui (D-CA) and Michael McCaul (R-TX), which would require the U.S. Department of Commerce to conduct a study of international IoT standards-setting bodies and organizations, and their effectiveness. These findings would further guide U.S. engagement with stakeholders to promote and strengthen international standards. 

This legislation is an important step toward ensuring the U.S. is part of the process to develop international, consensus-driven IoT standards and will help prevent country-specific standards from hindering the progress of American innovation. The development of effective, international IoT standards will support global collaboration on the establishment of secure operations through strong encryption, network security and cyber hygiene.  

At Tenable, we know firsthand how the increase in connected devices creates Cyber Exposure challenges. Effective U.S. engagement in international standards development will help address these challenges and make for a safer future. Through this important legislative effort, and the work of the private sector, the U.S. can play a leadership role in the creation of an interoperable, safe and secure future for these powerful emerging technologies. Leveraging private-public partnerships will remain a vital piece of securing IoT devices around the world, and Tenable looks forward to working with our partners in government and industry to ensure these devices can provide incredible benefits while minimizing the risk to users. 

Learn More:

• IoT Cybersecurity Improvement Act: An Important Step Forward
• Why Global Collaboration is Key to Effective Cyber Defense
• Cyber Exposure: Taking a Holistic Approach to Vulnerability Management

Popular open source FTP daemon affected by an improper access control vulnerability dating back to 2010

Background

On July 18, Tobias Mädel published an advisory for an improper access control vulnerability in a default module for ProFTPD, a popular open source FTP daemon for Unix and Unix-like operating systems.

Analysis

CVE-2019-12815 is an arbitrary file copy vulnerability in ProFTPD’s mod_copy module due to improper access control. According to the ProFTPD bug report for this vulnerability, mod_copy does not honor the “<Limit READ>” and “<Limit WRITE>” configuration settings in proftpd.conf, thereby allowing a remote attacker without write permissions to “copy any file on the FTP server” using CPFR and CPTO commands. This is possible under the following scenarios:

• The Anonymous user configuration is enabled on the vulnerable ProFTPD installation
• An attacker has working FTP credentials regardless of restrictions placed on the account

The former scenario is significant because it could allow a remote attacker to upload malicious files to a vulnerable server. Tenable has confirmed that anonymous user access is disabled by default when using Advanced Package Tool (APT) or Yellowdog Updater, Modified (YUM) package managers to install proftpd. However, anonymous user access is enabled by default from a source install from proftpd.org.

The vulnerability affects ProFTPD beginning with version 1.3.4. This is because the mod_copy module was not included as part of the default installation of ProFTPD until version 1.3.4, which was released in 2010.

In a July 23 update to his original advisory, Mädel states “Contrary to news reports, ProFTPd 1.3.6 is also affected and does not contain the fix. There is no patched release version available yet.”

Using an internet-connected search engine, like BinaryEdge, we believe that number is close to over 539,000 potentially exposed based on the affected versions greater than 1.3.4 up to and including 1.3.6. This search does not account for whether or not these systems have anonymous user access enabled.

According to Mädel’s disclosure timeline, he reported the vulnerability to ProFTPD’s security email alias on September 28, 2018, and subsequently reported it to the Debian Security Team on June 12, 2019. Mädel provided a deadline of July 28, 2019, for public disclosure. ProFTPD released a fix to address the vulnerability on July 17, 2019.

A similar vulnerability in mod_copy, CVE-2015-3306, was disclosed in 2015, though it could be exploited by an unauthenticated attacker, making it far more severe than CVE-2019-12815.

Proof of concept

No Proof-of-Concept code or exploit scripts were available at the time this blog was written. However, the vulnerability details are available in the ProFTPD bug report and simply require an attacker to be able to issue CPFR and CPTO commands either as an anonymous user (if enabled) or post-authentication.

Solution

According to the ProFTPD bug report, the fix for this vulnerability was merged in on July 17, 2019, and backported to the 1.3.6 branch. Various security trackers for Debian, Ubuntu and other Linux or Unix distributions show they remain unpatched and vulnerable. SUSE is not affected by this vulnerability. However, Mädel’s July 23 update to his advisory states that the vulnerability was not fixed in 1.3.6.

Until the patch is released and available downstream, users can disable mod_copy in the ProFTPD configuration file as a workaround.

Identifying affected systems

A list of Tenable plugins to identify this vulnerability will appear here as they’re released. Additionally, there are Tenable plugins to identify when Anonymous FTP access is enabled.

Get more information

• Tobias Mädel's Advisory for CVE-2019-12815
• ProFTPD Bug Tracker: CVE-2019-12815
• ProFTPD Bug Tracker: CVE-2015-3306

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 60-day trial of Tenable.io.

Protecting air-gapped networks from insider threat is a priority for the Lockheed Martin Aeronautics information systems security risk team. Here’s how they’re using Tenable.sc to keep the F-35 fighter jet secure.

Headquartered in Bethesda, MD, Lockheed Martin is a global security and aerospace company employing approximately 105,000 people worldwide. The organization is principally engaged in the research, design, development, manufacture, integration and sustainment of advanced technology systems, products and services.

Stephen Nevil, Senior Information Systems Security Risk Analyst with Lockheed Martin Aeronautics in Fort Worth, TX, performs compliance and vulnerability management for the company’s F-35 aircraft program. According to Lockheed Martin, the F-35 is the most lethal, survivable and connected fighter aircraft ever built. More than a fighter jet, the F-35’s ability to collect, analyze and share data enhances all airborne, surface and ground-based assets in the battlespace, enabling men and women in uniform to execute their mission and come home safe.

Nevil’s biggest challenge is securing six air-gapped networks, many of which are classified. “With...air-gapped networks, really, what are we concerned about?,” said Nevil in an interview with Tenable during the Edge 2019 user conference. “We're concerned about insider threats. And we're concerned about people taking data off our networks unauthorized, either bringing it on or taking it off. And so, you need to be able to identify that efficiently.”

Visit https://www.tenable.com/edge to watch keynotes and breakout sessions from the Tenable Edge 2019 user conference. 

The organization has been using Tenable.sc (formerly SecurityCenter) for about two-and-a-half-years. “It's fantastic seeing those tools develop and help us see what's happening on our networks,” said Nevil. “[It’s] been pretty incredible.”

The organization uses the data provided in Tenable.sc in a variety of ways to communicate with key stakeholders, including the Information Security Officers who manage the six air-gapped networks, the admins who are responsible for patch management and the senior executives who oversee cybersecurity spending decisions.

“There is a mountain of data you can get,” said Nevil. “You can get anything you want. I see about 826 different types of normalized logs every day, and what we had to do was focus on what is important, what's going to make us reach our goal of making sure we don't have insider threats, we don't have data coming on or coming off our network and that we're meeting the government standards.”

Sharing Data with Information Security Officers

Each of the six networks Nevil oversees has its own Information Security Officer with whom he is able to share data via Tenable.sc. “With [Tenable.sc], we have a single pane of glass where I can have my vulnerability data on there, I can have my compliance data and I can have my audit data and we review [it] all there, with just several dashboards. It's made the efficiency just skyrocket.”

When efficiencies skyrocket, the natural next question is: what are you doing with all the newfound time? The efficiencies made possible through Tenable.sc are enabling Nevil and his team to devote more time to analyzing the networks. “Previously, we couldn't do it effectively,” said Nevil. “This tool has just made it a leap for us to actually spend the time and dedicate it to actually understanding what's happening, what vulnerabilities we need to attack, what compliances we need to meet and what's happening on our network.”

The ability to understand what’s happening on the network “opened our eyes to all the stuff that we could be doing better,” said Nevil. Oftentimes, the data revealed that simple processes weren’t being followed or could be improved. For example, if someone generated a local user account to do testing and then forgot to delete it, “it's right there in your vulnerability scans,” said Nevil. “And you're like, ‘hey, you forgot to delete this test account that you made,’ and you can tell the admin to go fix it. So, it's fantastic.”

Helping Patch Admins to Prioritize

Tenable.sc has also helped Nevil and his team identify their priorities. “How do you eat an elephant?,” said Nevil. “One bite at a time. So, that's what we did. We took chunks of data and made it usable and attacked it.”

To help patch management admins, for example, Nevil’s team uses Tenable.sc to do automated scans and produce reports. “It runs a scan and on Monday morning, my admins have a report in their inbox that says, ‘hey, here's the top 10 vulnerabilities that I want you attack. Here's the top 10 dirtiest machines. Here's the top 10 oldest vulnerabilities I want you to attack and here are machines that aren't meeting compliance.’ So, they have just a couple things to hit, but if they hit those top 10 things, you know, that week, it's going to lower our vulnerabilities quite a bit.”

Tenable’s new Vulnerability Priority Rating (VPR) is designed to further refine the risk assessment and remediation processes. VPR, a new capability introduced this year in Tenable.sc and Tenable.io, is the output of Tenable’s new Predictive Prioritization offering. Introduced in February 2019, Predictive Prioritization combines Tenable-collected vulnerability data with third-party vulnerability and threat intelligence and analyzes them together using an advanced data science algorithm developed by Tenable Research. The data analysis is used to develop a VPR for each vulnerability.

“Anything that Security Center can do to help us prioritize more effectively is going to be incredibly useful,” said Nevil. “You don't have enough time to hit everything. It's just impossible. And we want to do better because we have the F-35 aircraft in our inventory. Our goal is to make it as secure as possible because the value of that aircraft drops dramatically if it's compromised. And we're not going to let that happen.”

Showing Executives the Value of Cybersecurity

Tenable.sc has also been valuable in giving Nevil’s senior managers data they can use to communicate with the organization’s executives about the value of cybersecurity spending. The tool makes it easy to build dynamic executive dashboards, which provide valuable context for decision-makers.

“[In cybersecurity] we consume resources, versus generating profit margin for Lockheed Martin.” said Nevil. “That's why it's so important that we can use this technology and we can have a secure network. We can show our management...even though we don't generate money, we're saving you tons of money in the end because if you lose all your profit margins because someone compromised us, you're starting over again.”

Watch Now:

Tenable interviews Stephen Nevil, Senior Information Systems Security Risk Analyst with Lockheed Martin Aeronautics, at our Edge 2019 user conference:

Learn More:

• Visit our Predictive Prioritization webpage here.
• Learn more about Tenable.sc here.

Dr. Larry Ponemon and Tenable’s Stephen Smith discuss the cybersecurity challenges revealed in a recent study of cybersecurity in the public sector, and provide three tips for closing the Cyber Exposure gap. 

It’s not easy to be a cybersecurity professional in the public sector these days.

While government agencies each face many of the same daily security risks as their private sector counterparts, public sector organizations have a unique set of challenges when it comes to cybersecurity. Among the issues facing public sector organizations are:

• Lack of visibility into the entire attack surface
• Limited technical resources and support
• Heavy reliance on manual processes to close the Cyber Exposure gap

Stephen Smith, Tenable’s Manager of State and Local Business Development, discussed these and other public sector cybersecurity challenges in a recent Tenable webinar featuring Dr. Larry Ponemon, Chairman and Founder of Ponemon Institute. 

During the webinar, the pair explored the findings outlined in the report, “Cybersecurity in Public Sector.” Commissioned by Tenable, the report was developed by Ponemon Institute, based on survey responses from 244 public sector infosec professionals from the United States, United Kingdom, Germany, Australia, Mexico and Japan. It highlights five key takeaways for public sector CISOs and their cybersecurity teams:

1. Cyberattacks in the public sector are relentless. 
2. Preventing attacks against IoT and operational technology (OT) infrastructure is a top priority for 2019.
3. Public sector cybersecurity teams face fundamental challenges managing cyber risk.
4. To help mitigate cyberattacks, new approaches for measuring cyber risks are needed.
5. Smarter prioritization of vulnerabilities is key to staying ahead of cyberattackers.

Cybersecurity Priorities in the Public Sector

Smith and Ponemon delved into the details on each of these five critical points and discussed what they reveal about the current state of cybersecurity in the public sector.

Cyberattacks in the public sector are relentless

The vast majority of organizations surveyed for the Ponemon report (88 percent) said they have sustained at least one damaging cyberattack over the last two years. In fact, 62 percent of respondents reported their agencies have sustained two or more damaging cyberattacks in the last 24 months. Many of the incidents have caused data breaches resulting in disruption and downtime, including the loss of day-to-day operations and equipment malfunctions.

Preventing attacks against IoT and OT infrastructure is a top priority for 2019

Nearly two thirds of respondents (65 percent) said they are most concerned about the possibility of attacks involving IoT or OT assets this year. As in the private sector, public sector cybersecurity professionals are now taking more responsibility for OT security as well as IT security, which means they are responsible for an ever-expanding attack surface. 

Another 61 percent of respondents said they are worried about the downtime to plants or equipment that would result from an attack against OT infrastructure.

A third of respondents (33 percent) are also concerned about the possibility of an employee falling for a phishing email. This concern is understandable, given that 56 respondents reported at least one such incident resulting in credential theft during the previous two years.

Despite the fact that phishing remains a top concern, Smith said public sector CISOs have made great strides in actually reducing the number of phishing attacks within their organizations. “We get a chance to...talk to a lot of public sector organizations and we participate in several councils, including one with the National Governors Association, and this topic was a significant topic in all of those conversations last year,” said Smith. “Now, what you are starting to see is organizations actually taking pride in the degree which they have reduced successful phishing attacks in their organizations.”

Public sector cybersecurity teams face fundamental challenges managing cyber risk

Only 23 percent of survey respondents report having sufficient visibility into their organization’s attack surface. This should come as no surprise, since 62 percent of respondents also say they lack adequate staffing to scan for vulnerabilities in a timely manner. 

New approaches for measuring and mitigating cyber risks are needed

The Ponemon data make clear that traditional key performance indicators (KPIs) are not adequate to provide an accurate picture of the cyber risks facing public sector organizations today. In fact, only 40 percent of respondents said they even attempt to quantify the impact that common cybersecurity incidents could have on their organizations.

And even if they could improve their ability to measure business impact, there’s little consensus on what, exactly, they would choose to measure. Of those respondents who are currently attempting to quantify business impact, 50 percent attempt to quantify the cost of OT-system downtime. The frequency of unpatched — but known — vulnerabilities is tracked by 46 percent of these respondents. 

Smarter prioritization of vulnerabilities is key to staying ahead of cyberattackers

Nearly a third (63 percent) of respondents report wanting to improve their ability to keep up with the sophistication and stealth of attackers. However, 44 percent say they currently prioritize threats based on the ease of remediation. A better way for CISOs to prioritize, according to the data, is to take a harder look at those threats that pose the greatest risk. Not all vulnerabilities need to be patched right away if they don’t present an immediate threat to the network.

Closing the Cyber Exposure gap to strengthen public sector cybersecurity

What Smith suggested, and what the Ponemon research supports, is a holistic approach to public sector security so that CISOs and their organizations can prioritize their needs at a time when adding more people and more resources is not possible.

Smith and Ponemon offered three tips public sector cybersecurity professionals can use to help close their Cyber Exposure gaps: 

1. Look for ways to improve your vulnerability prioritization. Tenable researchers reported over 16,500 were disclosed in 2018 — most of which were high or critical severity. Yet, only a small fraction of those vulnerabilities are being actively exploited. By using new technology and techniques, e.g.,data science and machine learning, public sector cybersecurity pros can more effectively prioritize vulnerability remediation to focus on those vulns posing the greatest risk of exploitation.
2. Make use of passive monitoring, especially for OT assets. While most organizations and their security teams would like to actively scan their entire environment, when it comes to OT, they’re deterred from doing so because active scanning can cause service interruptions by knocking business-critical systems offline. Instead, Smith recommended passive monitoring, which provides much-needed visibility into OT environments without disrupting sensitive systems.
3. Implement continuous asset discovery and vulnerability assessment. Adding or removing computing assets can change overall security posture. Since remediation must often occur during small windows of downtime, the most complete and current data regarding vulnerabilities and their predicted risks is critical, which is why Tenable recommends making continuous monitoring a top priority.

Learn more:

• Download the webinar Cybersecurity in the Public Sector — 5 Insights You Need to Know
• Read the Ponemon report Cybersecurity in the Public Sector: 5 Insights You Need to Know
• Download the eBook 3 Things You Need to Know About Prioritizing Vulnerabilities