This month's update for our AppDetectivePRO and DbProtect Knowledgebase is now available.
Knowledgebase version 4.51 includes new and/or updated checks for vulnerabilities in Oracle Database and MySQL.
NOTE: AppDetectivePRO users MUST upgrade to version 8.5.1 prior to installing Knowledgebase update 4.51. Users can download AppDetectivePRO version 8.5.1 from within the Trustwave support portal.
New Vulnerability and Configuration Check Highlights
MySQL
- CREATE USER privileges granted
- Checks whether the CREATE USER privilege has been granted to users.
- Risk: Medium
- Relevant CVEs: N/A
- Error logging not enabled
- Verifies that the error log is sent to a file.
- Risk: Low
- Relevant CVEs: N/A
- GRANT OPTION privileges granted
- Checks whether the GRANT OPTION privilege has been granted to users.
- Risk: Informational
- Relevant CVEs: N/A
- Merge engine not disabled
- Verifies if the merge engine is enabled.
- Risk: Low
- Relevant CVEs: N/A
- RELOAD privileges granted
- Check whether the RELOAD privilege has been granted to users.
- Risk: Informational
- Relevant CVEs: N/A
- Root user exists
- Verifies whether the user 'root' is present.
- Risk: Medium
- Relevant CVEs: N/A
- Secure authentication required
- Verifies that secure authentication (using new password hash format) is required.
- Risk: Medium
- Relevant CVEs: N/A
- Skip-grant-tables enabled
- Verifies that the server was not started with option skip-grant-tables.
- Risk: High
- Relevant CVEs: N/A
Oracle
- Encryption of audit data records
- Verifies that audit data records are encrypted.
- Risk: Medium
- Relevant CVEs: N/A
- Permissions on SYSDBA Password file
- Checks that excessive permissions have not been granted on the SYSDBA password file.
- Risk: High
- Relevant CVEs: N/A
Updated Checks
MySQL
- Latest release not installed
- Support for MySQL versions 5.5.44 and 5.6.25
- Risk: High
- Relevant CVEs: N/A
- Latest release not installed on time
- Support for MySQL versions 5.5.44 and 5.6.25
- Risk: High
- Relevant CVEs: N/A
How to Update?
All AppDetectivePRO and DbProtect customers can download the latest Knowledgebase Update by visiting the Trustwave support portal at https://trustwave.com/Company/Support and selecting either the AppDetectivePRO or DbProtect product.
AppDetectivePRO customers can also update their deployment by launching the "Updater" within the product.