Release Notes August 2020

Release Date: 2020-08-31

Version: G4.19-13.0

Announcements

Future Changes to How We Report Some Netsec Findings

As we continually improve our scan engine and the ways we report findings, we also collaborate with customers who provide valuable feedback on how we report certain findings to ensure that we can provide the best possible information, tied to the highest accuracy we can achieve. We also want to ensure we remove all possible confusion from findings and how we find them.

Based on feedback from a large number of customers, we are working towards refactoring the way we report the port number for what we term Implied Vulnerabilities where we may not be able to authenticate with the Operating System, but we can use other information gathered to make accurate assumptions.

For example, we enumerated the version of Windows based on another service (HTTP, SNMP etc.), and report the finding as TCP 445 on Windows or TCP 22 for Linux. If this port is unavailable there is a potential to cause some confusion if findings where reported on TCP 445, and that port was not registered in the port scan phase. To mitigate this risk for confusion, the assumed port number is now reported as Generic.

We are working towards ensuring that this change has as little impact on your current workflows as possible, and how we can ensure the continuation of Accepted Risks and False Positives across this change. Further updates will be provided during the completion of this change.

Update to the Database Integration Library

Libraries used for integrating with MySQL when used within the Event Notifications has been upgraded.

Supported MySQL versions:

5.6
5.7
8.0

When using the integration into MySQL, ensure that one of the supported versions is used.

New Features

Portal

Added further widgets to the Dashboard in the Portal. This is currently still in beta and so only available to limited customers. Should you wish to join the beta program, please contact your account manager.

Netsec

If you have multiple Windows Domains, and Windows workstations could be a member of any of those domains, it is now possible to add multiple sets of SMB credentials to a single scan policy.

Cloudsec Inspect

Added Container inspection for Docker private registries and AWS Elastic Container Registries. This is currently still in beta and so only available to limited customers.
To join the beta program, contact your account manager.

Bug Fixes and Minor Improvements

Portal

Improved detection for phpMyAdmin.
Improved detection for Wordpress versions.
Improved detection for XSS attacks.
Improved detection for Blind and reflected SQL injection attacks.
Made improvements to the way Scale detects vulnerabilities resulting in more accurate findings being presented.

Netsec

Improved detection for Horde IMP.
Added detection for CVE-2020-3452 (Cisco ASA/FTD web services flaw).
Added detection for CVE-2020-17496 (vBulletin unauthenticated remote code execution).
Fixed an issue that prevented scans started where the Global/Last checks was enabled on the scan policy.
Fixed a bug that prevented users stretching the maintaining targets window in the Outscan UI.
Fixed an issue with Outscan internal that prevented help information showing when selecting the help option.
Fixed a rare issue in report summary's that resulted in High/Medium/Low issues showing 0 when applying specific filters.
Improved detection for "Unencrypted Remote Authentication Available - RPC".
Improved detection for phpMyAdmin.
Improved detection for Wordpress versions.
Improved detection for MikroTik RouterOS.

Agents

Fixed an issue with the call home frequency that prevented it being reset to the default value.
Fixed an issue where the Agent may stop calling home until the next Agent restart
Fixed an issue when signing log files

MSSP platform

Fixed a rare bug that prevented installation of packages on HIABs when certain custom encryption keys were used.

End of Life Announcement

Elastic Workload Protector (EWP)

Official End of Life date: 30th September 2020.
Official End of Support date: 31st December 2020.

_Copyright

_{© 2024 Outpost24® All rights reserved.}_{This document may only be redistributed unedited and unaltered. This document may be cited and referenced only if clearly crediting Outpost24® and this document as the source. Any other reproduction and redistribution in print or electronically is strictly prohibited without explicit permission.}

_Trademark

_{Outpost24® and OUTSCAN™ are trademarks of Outpost24® and its affiliated companies. All other brand names, product names or trademarks belong to their respective owners.}