This month's update for Database Security Knowledgebase is now available.
Knowledgebase version 5.00 includes new checks for Microsoft SQL Server, MySQL, Oracle and Teradata and new CIS policies for MySQL v1.0.2 and Oracle 11gR2 v2.0.0.
New Vulnerability and Configuration Check Highlights
Microsoft SQL Server
- ALTER SERVER STATE permission granted
- Lists logins and roles granted the ALTER SERVER STATE permission.
- Risk: Medium
- Relevant CVEs:N/A
MySQL
- User interactive login not disabled
- Verifies that the account used to run the MySQL server is not allowed to login interactively to the OS.
- Risk: Medium
- Relevant CVEs:N/A
Oracle
- AUDIT_ADMIN role granted
- List all accounts granted AUDIT_ADMIN role.
- Risk: Low
- Relevant CVEs:N/A
- Permissions granted on DBMS_AUDIT_MGMT
- Check that permissions on package DBMS_AUDIT_MGMT have not been granted.
- Risk: Low
- Relevant CVEs:N/A
Teradata
- Latest patch not applied
- Verify that the latest patches are applied to the database.
- Risk: High
- Relevant CVEs:N/A
New Policies
- CIS v1.0.2 for MySQL 5 - Audit (Built-in)
- CIS v2.0.0 for Oracle 11gR2 - Audit (Built-in)
- These policies has been created with guidance of the security configuration benchmarks by the Center for Internet Security.
- Note that AppDetectivePRO users should use the CIS NEW! Policy as the new policies are part of the super set of CIS policies.
Availability
- Available to allAppDetectivePRO and DbProtect customers with maintenance (subscription or perpetual) in good standing at no additional cost
- AppDetectivePRO customers can use the Updater within the product as well