Several months back I was updating our vulnerability scanner checks for various Solarwinds products. As I added a detection script for a product called Log and Event Manager (LEM), I realized that there were really no significant publicly disclosed vulnerabilities for it. This spurred me to download their trial, which comes as a virtual appliance, and look for some flaws. After initially setting...

Title: DDIVRT-2015-55 SolarWinds Log and Event Manager Remote Command ExecutionSeverity: HighDate Discovered: August 15, 2015Discovered By: Chris Graham @cgrahamsevenVulnerability Description:SolarWinds Log and Event Manager (LEM) is vulnerable to an Extensible Markup Language (XML) external entity injection through the agent message processing service. This service listens on TCP port 37891....

If your organization is required to comply with the Payment Card Industry-Data Security Standard (PCI-DSS), particularly Requirement 11, then you are likely familiar with the problems plaguing SSL, early TLS (i.e. TLSv1.0) and their supported ciphers over the past several months. High profile vulnerabilities such as HeartBleed, POODLE, FREAK and LogJam have sent merchants scrambling to patch...

Recently in Arstechnica.com there was an article bringing light to how Windows computers can be exploited when booby-trapped USB fobs are inserted into the machine that then executes malicious code.Microsoft has acknowledged this and released a security bulletin regarding the issue stating, “To exploit the vulnerability, an attacker would have insert a malicious USB device into a target system.”So...

I recently came across a post on LinkedIn, asking about advice related to vulnerability management (VM) and specifically as it relates what elements should be included in the process. I found many participants giving advice which was more assessment related, as opposed to VM related. Seeing this confusion out there, I felt it important to share my views on the differences. So what is the...

Given the popularity of the Mac and the ever increasing number of users, we thought it would be good to share insight that everyone, regardless of what they use their Mac for, should do to protect their system and their data. This list is not all inclusive; however, it does give most users much more control over the security and privacy of their data. Under System Preferences >> Security &...

During some recent research, I came across two issues in a large vulnerability management (VM) vendor’s public community support forum. The first post described a problem in which their tool reported a different number of network endpoint assets from what was seen on “the console.” The second detailed a user experiencing duplicate assets. After some investigation, I determined that both issues...

I was recently putting together material for a recurring vulnerability management meeting with one of our clients. This involves comparing authenticated scanning results from one scanning period to the next in an effort to determine progress in addressing high-risk vulnerabilities; particularly, missing Microsoft, Adobe and Java patches, as vulnerabilities in these products are generally...

Are you Vulnerable to a breach due to the “Shellshock" bug?The “Shellshock" Bash vulnerability is a serious information security issue . It is a powerful attack affecting businesses of all sizes and industries. Fortra's Vulnerability Management has teams of vulnerability researchers and personal security analysts addressing concerns, mitigating risk and answering commonly asked questions.Q: What...

Banks gain competitive advantage with capacity planning in digital age. Capacity management tools are a crucial part of modern enterprise systems – and they are rarely more necessary than in the world of high finance, where uptime and latency really matter.

Using Application Compatibility Fixes To Bypass User Account Control An often-overlooked method that can be used by an attacker to gain elevated code execution is utilization of a framework that is provided by Microsoft to help legacy applications function on newer versions of Windows. That framework is known as the application compatibility toolkit. Unfortunately, in addition to allowing legacy...

FINDING CVE-2013-5014 AND CVE-2013-5015Sometimes there is nothing more ironic than coming across critical vulnerabilities in the very security software designed to protect systems. In these cases not only does the security software fail to prevent an intrusion; it actually becomes the vector that allows system compromise of an otherwise secure machine. Several antivirus products have had these...

DEEP DIVE ANALYSIS OF CVE-2013-2347One of the benefits our clients have when using our vulnerability scanner is that many of the vulnerability checks we write are non-authenticated. This means that we do not require credentials to authenticate to hosts over the network in order to check for vulnerabilities. Instead, our team of researchers frequently reverse engineers software to identify unique...

Capacity planning solutions can help organizations make the best use of limited resources in their IT environments.

DDIVRT-2013-55 LenovoEMC StorageCenter PX4-300R Unauthorized Remote File RetrievalDate Discovered: October 10, 2013Discovery Credit: Evan Sylvester and r@b13$Vulnerability Description: The web server for the LenovoEMC StorageCenter PX4-300R allows unauthenticated remote users to retrieve specific files that are located outside of the web root. Malicious users would need to have direct knowledge of...

A note to our readers....The following is a blog post our organization was withholding while privately warning companies about a set of critical IPMI vulnerabilities in their rack mount hardware and the threat they posed to their security posture. Some of the content was covered in a B-Sides San Antonio talk two months ago by one of our researchers.Today the full-scope of this threat was...

Follow us on Twitter! Severity--------High Date Discovered---------------March 19, 2013 Discovered By-------------Digital Defense, Inc. Vulnerability Research TeamCredit: Dennis Lavrinenko, Bobby Lockett, and r@b13$ 1. Actuate 'ActuateJavaComponent' Arbitrary File Retrieval Vulnerability Description-------------------------Actuate 10 contains a vulnerability within the 'ActuateJavaComponent'. This...

DDIVRT-2013-50 EverFocus EPARA264-16X1 Directory TraversalFollow us on Twitter! Title-----DDIVRT-2013-50 EverFocus EPARA264-16X1 Directory Traversal Severity--------High Date Discovered---------------January 22, 2013 Discovered By-------------Digital Defense, Inc. Vulnerability Research TeamCredit: r@b13$ Vulnerability Description-------------------------The EverFocus EPARA264-16X1 DVR allows...