Tenable Network Security Podcast Episode 164 - "Detecting Portable Devices, Losing Private Keys"
Announcements
- We're hiring! - Visit the Tenable website for more information about open positions.
- Check out our video channel on YouTube which contains new Nessus and SecurityCenter tutorials.
- Tenable Tweets - You can find us on Twitter at http://twitter.com/tenablesecurity where we make product and company announcements, provide Nessus plugin statistics, and more!
- Want to ask questions about Nessus, SecurityCenter, LCE, and PVS and get answers from the experts at Tenable? Join Tenable's Discussion Forum for custom scripts, announcements, and more!
- You can subscribe to the Tenable Network Security Podcast on iTunes!
New & Notable Plugins
Nessus
General
- Gallery < 3.0.5 Multiple Vulnerabilities - Gallery is a PHP application for image management and presentation on your website. This type of application is plagued with vulnerabilities.
- Piwigo install.php dl Parameter Traversal Arbitrary File Access - Case in point, this is another image gallery PHP application.
- Core FTP < 2.2 build 1769 Multiple Buffer Overflows - Client-side FTP vulnerability
- Microsoft Windows Portable Devices - A fantastic new plugin that enumerates the devices plugged into your Windows systems
- VNC Server Unencrypted Communication Detection - A splash of configuration auditing, this plugin checks to be certain the VNC server is using encryption.
- Default Password (facepunch) for 'chronos' Account - Default account in Google's operating system
Application Detection
Mozilla
- Firefox ESR 17.x < 17.0.5 Multiple Vulnerabilities (Mac OS X)
- Firefox 19.x Multiple Vulnerabilities (Mac OS X)
- Thunderbird 17.x < 17.0.5 Multiple Vulnerabilities (Mac OS X)
- Thunderbird ESR 17.x < 17.0.5 Multiple Vulnerabilities (Mac OS X)
- Firefox ESR 17.x < 17.0.5 Multiple Vulnerabilities
- Firefox 19.x Multiple Vulnerabilities
- Mozilla Thunderbird 17.x < 17.0.5 Multiple Vulnerabilities
- Mozilla Thunderbird ESR 17.x < 17.0.5 Multiple Vulnerabilities
- SeaMonkey 2.16.x Multiple Vulnerabilities
Passive Vulnerability Scanner
Vulnerability Detection
Several recent news articles pointed to vulnerabilities in PostgresSQL. Below are plugins to detect them in your environment.
General Detection
From the plugin description: Financial Information eXchange (FIX) protocol. The remote client is running a FIX application. This protocol is used by financial institutions to exchange data. The FIX protocol has very few built-in security controls and, instead, relies on industry standard encryption (PGP, SSL/TLS, etc.) to protect the stream. The PVS has just observed this client initiate a LOGON request without encryption set.
- FIX client LOGON detection
- FIX client PGP LOGON detection
- FIX Server Detection
- FIX Server LOGON detection
- Varnish Cache Detection - Varnish sits in front of your web applications and improves performance.
SecurityCenter Report Templates
- Exploits By Platform - Traces the exploitability of vulnerabilities in your environment using the three most popular exploit frameworks
Stories
- AMI Firmware Source Code, Private Key Leaked | threatpost
- Command Injection Tips: Leveraging Command-line Kung Fu with nslookup
- Bitcoin-mining malware enslaves computers
- Veracode Predicts Rise of "Everyday Hacker"
- Parking Ticket Firm Exposes Private Information
- Fake Twitter Followers Becomes Multimillion Dollar Business
Related Articles
Tenable Network Security Podcast Episode 198 - "PCI Discussion Featuring Jeffrey Man"
February 13, 2014<p></p>
Securing Financial Data in the Cloud: How Tenable Can Help
November 4, 2024Preventing data loss, complying with regulations, automating workflows and managing access are four key challenges facing financial institutions. Learn how Tenable can help.
Cybersecurity Snapshot: Apply Zero Trust to Critical Infrastructure’s OT/ICS, CSA Advises, as Five Eyes Spotlight Tech Startups’ Security
November 1, 2024Should critical infrastructure orgs boost OT/ICS systems’ security with zero trust? Absolutely, the CSA says. Meanwhile, the Five Eyes countries offer cyber advice to tech startups. Plus, a survey finds “shadow AI” weakening data governance. And get the latest on MFA methods, CISO trends and Uncle Sam’s AI strategy.
FY 2024 State and Local Cybersecurity Grant Program Adds CISA KEV as a Performance Measure
October 31, 2024The CISA Known Exploited Vulnerabilities (KEV) catalog and enhanced logging guidelines are among the new measurement tools added for the 2024 State and Local Cybersecurity Grant Program.
- Podcast