Database Security Knowledgebase Update 5.11

This month's update for Database Security Knowledgebase is now available.

Knowledgebase version 5.11 includes new checks for MySQL, SQL Server and Oracle as well as updated checks for SQL Server andMySQL.

New Vulnerability and Configuration Check Highlights

MySQL

• Critical Patch Update - January 2017
  • Check version to determine if the database contains vulnerabilities described by Critical Patch Update - January 2017
  • Risk: High
  • Relevant CVEs: CVE-2016-8318 CVE-2016-8327 CVE-2017-3238 CVE-2017-3243 CVE-2017-3244 CVE-2017-3251 CVE-2017-3256 CVE-2017-3257 CVE-2017-3258 CVE-2017-3265 CVE-2017-3273 CVE-2017-3291 CVE-2017-3312 CVE-2017-3313 CVE-2017-3317 CVE-2017-3318 CVE-2017-3319 CVE-2017-3320

SQL Server

• Disable Filestream Feature
  • Check that the Filestream feature is disabled
  • Risk: Informational
  • Relevant CVEs: N/A

• Server is Synchronized with an official time server
  • Verify that the Windows operating system is configured to synchronize with an official time server, using Network Time Protocol (NTP)
  • Risk: Medium
  • Relevant CVEs: N/A

Oracle

• Critical Patch Update/Patch Set Update – January 2017
  • Check version to determine if the database contains vulnerabilities described by Critical Patch Update/Patch Set Update - January 2017
  • Risk: High
  • Relevant CVEs: CVE-2017-3240 CVE-2017-3310

Updated Checks

SQL Server

• Latest service pack/hot fix not applied
  • Latest service pack/hot fix not applied. Updated to check for Microsoft SQL Server 2016 Service Pack 1
  • Risk: High
  • Relevant CVEs: N/A

• Service pack not applied on time
  • Updated to check for Microsoft SQL Server 2016 Service Pack 1
  • Risk: High
  • Relevant CVEs: N/A

MySQL

• Latest release not installed
  • Support MySQL 5.5.54, 5.6.35 and 5.7.17
  • Risk: High
  • Relevant CVEs: N/A

• Release update not installed on time
  • Support MySQL 5.5.54, 5.6.35 and 5.7.17
  • Risk: High
  • Relevant CVEs: N/A

Availability

• Available to all AppDetectivePRO and DbProtect customers with maintenance (subscription or perpetual) in good standing at no additional cost
• AppDetectivePRO customers can use the Updater within the product as well