This month's update for Database Security Knowledgebase is now available.
Knowledgebase version 5.04 includes new checks for SAP (Sybase) ASE, Microsoft SQL Server, MySQL and Oracle, and updated checks for Microsoft SQL Server.
New Vulnerability and Configuration Check Highlights
SAP (Sybase) ASE
- Auditing of configuration changes not enabled
- Check if auditing of configuration changes is enabled.
- Risk: Medium
- Relevant CVEs:N/A
- Account properties
- Report account properties.
- Risk: Informational
- Relevant CVEs:N/A
Microsoft SQL Server
- Account properties
- Report account properties.
- Risk: Informational
- Relevant CVEs:N/A
- Microsoft SQL Server 2014 SP2 not installed
- Verify that Microsoft SQL Server 2014 SP2 is installed.
- Risk: High
- Relevant CVEs:N/A
MySQL
- Critical Patch Update - July 2016
- Check version to determine if the database contains vulnerabilities described by Critical Patch Update - July 2016.
- Risk: High
- Relevant CVEs:CVE-2016-2105, CVE-2016-3424, CVE-2016-3440, CVE-2016- 3452, CVE-2016-3459, CVE-2016-3471, CVE-2016-3477, CVE- 2016-3486, CVE-2016-3501, CVE-2016-3518, CVE-2016-3521, CVE-2016-3588, CVE-2016-3614, CVE-2016-3615, CVE-2016- 5436, CVE-2016-5437, CVE-2016-5439, CVE-2016-5440, CVE- 2016-5441, CVE-2016-5442, CVE-2016-5443, CVE-2016-5444
- Systemwide password expiration
- Verify that systemwide password expiration is within the policy parameters.
- Risk: Medium
- Relevant CVEs:N/A
- Per login password expiration
- Verify that per login password expiration is within the policy parameters.
- Risk: Medium
- Relevant CVEs:N/A
Oracle
- Critical Patch Update/Patch Set Update - July 2016
- Check version to determine if the database contains vulnerabilities described by Critical Patch Update/Patch Set Update -July 2016.
- Risk: High
- Relevant CVEs:CVE-2015-0204, CVE-2016-3448, CVE-2016-3467, CVE-2016- 3479, CVE-2016-3484, CVE-2016-3488, CVE-2016-3489, CVE- 2016-3506, CVE-2016-3609
- Account properties
- Report account properties.
- Risk: Informational
- Relevant CVEs:N/A
Updated Checks
Microsoft SQL Server
- Latest service pack/hot fix not applied
- Updated to check for Microsoft SQL Server 2014 Service Pack 2.
- Risk: High
- Relevant CVEs:N/A
- Service pack not applied on time
- Updated to check for Microsoft SQL Server 2014 Service Pack 2.
- Risk: High
- Relevant CVEs:N/A
Availability
- Available to allAppDetectivePRO and DbProtect customers with maintenance (subscription or perpetual) in good standing at no additional cost
- AppDetectivePRO customers can use the Updater within the product as well
