HP Security Products Blog
From applications to infrastructure, enterprises and governments alike face a constant barrage of digital attacks designed to steal data, cripple networks, damage brands, and perform a host of other malicious intents. HP Enterprise Security Products offers products and services that help organizations meet the security demands of a rapidly changing and more dangerous world. HP ESP enables businesses and institutions to take a proactive approach to security that integrates information correlation, deep application analysis and network-level defense mechanisms—unifying the components of a complete security program and reducing risk across your enterprise. In this blog, we will announce the latest offerings from HP ESP, discuss current trends in vulnerability research and technology, reveal new HP ESP security initiatives and promote our upcoming appearances and speaking engagements.

Displaying articles for: August 2010

Top Five Web Application Vulnerabilities 8/16/2010 - 8/30/2010

1) Oracle Secure Backup Administration uname Authentication Bypass Vulnerability

 

Oracle Secure Backup is susceptible to an authentication bypass vulnerability that allows remote attackers to bypass authentication on vulnerable systems due to a lack of the application to properly validate user-supplied input. Successful exploitation would give an attacker access to sensitive information running on the administration server. An update which resolves this vulnerability has been released. Contact the vendor for additional information.

 

http://www.securiteam.com/securitynews/5HP35002BS.html
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0904

 

2) Apache CouchDB Cross-Site Request Forgery Vulnerability

 

Apache CouchDB is susceptible to a Cross-Site Request Forgery attack. Cross-Site Request Forgery relies on a browser to retrieve and execute an attack. It includes a link or script in a page that connects to a site that the user may have recently used. The script then conducts seemingly authorized yet malicious actions on the user’s behalf. Updates which resolve this vulnerability are available. Contact the vendor for more information.

 

http://www.securityfocus.com/bid/42501
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2234

 

3) Adobe ColdFusion Directory Traversal Vulnerability

 

Adobe ColdFusion is susceptible to a Directory Traversal vulnerability. Successful exploitation would give an attacker unauthorized access to sensitive information which would likely lead to more damaging attacks. Updates which resolve this vulnerability are available. Contact the vendor for further details.

 

http://www.securityfocus.com/bid/42342
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2861

 

4 )Cisco Wireless Control System (WCS) Unspecified SQL Injection Vulnerability

 

Cisco Wireless Control System (WCS) is susceptible to a SQL Injection vulnerability. This can give an attacker full access to a backend database when successfully exploited, and in certain circumstances can be utilized to take complete control of a system. Updates which resolve this vulnerability are available. Contact the vendor for more details.

 

http://www.securityfocus.com/bid/42368
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2826

 

5) BugTracker.NET Custom Field SQL Injection Vulnerability

 

BugTracker.NET is susceptible to a SQL Injection vulnerability. Successful exploitation could give an attacker the means to access or modify backend database contents, or in some circumstances be utilized to take control of the server hosting the database. Users can resolve this issue by upgrading to version 3.4.4. Contact the vendor for additional details.

 

http://secunia.com/advisories/41150/

HP has ‘Fortified’ application security

As you can imagine, we're very excited in the Application Security Center about HP's upcoming acquisition of Fortify. What's great about this is that our strengths are exceedingly complimentary (as static and dynamic analysis should be...it's the yin and yang of application security, and will allow us to provide customers with a complete security package that addresses the entire application development lifecycle). And since we've already worked with Fortify on enhancing and integrating application security solutions, we know exactly the value they bring to the table. Granted, I might be biased (totally). But, it's not just me. Here's what some analysts have said this week:

 

“I think it is a great move for HP.  It is a perfect fit for their tools given the integration they have done with Fortify over the past few months. Developing secure applications will always be important and too many app dev organizations don’t know where to begin.”

~ Mike Gualtieri, Forrester Research

 

“When big companies like IBM and HP make acquisitions like this they're going to make these technologies easier to consume for more folks. There is a small, but growing market demand for more secure development."

~Josh Corman, The 451 Group

 

Stay tuned for more ex citing news. And for more information on HP's acquisition of Fortify, follow this link:

http://www8.hp.com/us/en/hp-news/article_detail.html?compURI=tcm:245-590591&pageTitle

Top Five Web Application Vulnerabilities 8/2/2010 - 8/15/2010

1) HP OpenView Network Node Manager 'OvJavaLocale' Cookie Value Remote Code Execution Vulnerability

 

HP OpenView Network Node Manager is susceptible to a remote code execution vulnerability because of a failure of the application to properly sanitize user-supplied input. Successful exploitation would give an attacker the means to run arbitrary code with the privileges of the user running the web server. Updates which resolve this vulnerability are available. Contact the vendor for additional information.

 

http://www.securityfocus.com/bid/42154
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2709

 

2) IBM WebSphere Service Registry and Repository Multiple Cross-Site Scripting Vulnerabilities

 

IBM WebSphere Service Registry and Repository is susceptible to multiple Cross-Site Scripting vulnerabilities. These vulnerabilities can be exploited to execute code in the browser of an unsuspecting user and steal cookie-based authentication credentials. Updates which resolve these vulnerabilities are available. Contact the vendor for further details.

 

http://www.securityfocus.com/bid/42281

 

3) Apache SLMS Insufficient Quoting Cross-Site Request Forgery Vulnerability

 

Apache SLMS is susceptible to a Cross-Site Request Forgery vulnerability. Cross-Site Request Forgery leverages the trust a web application places in a user to make authenticated requests to a target site for which the user is logged in, and can be used to abuse any type of functionality the target web application contains. Updates which resolve this vulnerability are available. Contact the vendor for more information. 

 

http://www.securityfocus.com/bid/42121
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1325

 

4) Adobe ColdFusion CVE-2010-2861 Unspecified Directory Traversal Vulnerability

 

Adobe ColdFusion is susceptible to a Directory Traversal vulnerability. Successful exploitation would give an attacker access to sensitive information which could likely be utilized in conducting more damaging attacks. Updates which resolve this vulnerability are available. Contact the vendor for more details.

 

http://www.securityfocus.com/bid/42342
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2861


5) Bugzilla Multiple Vulnerabilities

 

Bugzilla is susceptible to vulnerabilities including a security bypass issue, several instances of information disclosure, and multiple denial-of-service attacks. Successful exploitation can reveal sensitive information, give unintended access to malicious users, and deny legitimate users access to the application. Updates which resolve these vulnerabilities are available. Contact the vendor for further information.

 

http://www.securityfocus.com/bid/42275
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2756
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2757
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2758
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2759

Companies average one successful cyber attack per week…and one is all it takes

The Ponemon Institute recently released the First Annual Cost of Cyber Crime Study and revealed some interesting statistics. For one, it's not that cyber attacks are plentiful...we've known that for a long time. It's just how successful they are that is surprising. The 45 organizations in this survey suffered on average 50 successful attacks per week among them, which of course averages out to more than 1 successful attack per company per week. Considering it only takes one successful exploitation of certain types of vulnerabilities (I'm talking to you, SQL Injection) to leave behind malicious code that can compromise an entire network, that's an incredibly revealing insight into the current state of security.

 

Successful attacks are also costly. Damages to the organizations in this survey ranged from $1 million to $52 million per year per company, with the median being $3.8 million per year. With increased fines for non-compliance with governmental regulations as well as the costs to fix vulnerabilities in production code both increasing, that number is only going to go up.

 

Not surprising, however, was the fact that the most costly cyber crimes are those caused by web attacks, malicious code, and malevolent insiders. Those three things account for a whopping 90% of all annual cyber crime costs per corporation.

 

View the full report here:

http://www.arcsight.com/collateral/whitepapers/Ponemon_Cost_of_Cyber_Crime_study_2010.pdf

Nearly half of all 2010 web application attacks were either XSS or SQL Injection

As always, there were a ton of interesting statistics revealed during Black Hat. Even companies that aren't in HP's league (ahem) occasionally find something worth sharing. The First Half 2010 Web Application Security Trends Report is just such an example. It's amazing that in 2010 when web application security should be well past its infancy that nearly half of all web application attacks conducted so far this year were either Cross-Site Scripting (28%) or SQL Injection (20%) attacks. It seems white listing user-supplied input and parameterizing SQL queries have yet to catch on. Another jaw-dropping revelation is that of the 4,000+ vulnerabilities discovered in the first half of this year, 60% have no solution. Complicating matters even further, almost a thousand vulnerabilities have exploitable code samples publically available while at the same time having no available fix. It's a hacker's world right now.  If only developers could share secure coding practices as easily as hackers do exploitable code.

 

http://www.marketwire.com/press-release/Cenzic-First-Half-2010-Web-Application-Security-Trends-Report-Reveals-60-Percent-Web-1296672.htm

Top Five Web Application Vulnerabilities 7/20/2010 - 8/1/2010

1) Microsoft Outlook Web Access for Exchange Server 2003 Cross-Site Request Forgery Vulnerability

 

Microsoft Outlook Web Access for Exchange Server 2003 is susceptible to a Cross-Site Request Forgery vulnerability. Cross-Site Request Forgery relies on a browser to retrieve and execute an attack. It includes a link or script in a page that connects to a site that the user may have recently used. The script then conducts seemingly authorized yet malicious actions on the user’s behalf. As of this writing, a fix has not yet been released. Contact the vendor for additional information.

 

http://www.securityfocus.com/bid/41843

 

2) SAP Netweaver 'wsnavigator' Cross-Site Scripting Vulnerability

 

SAP Netweaver is susceptible to a Cross-Site Scripting vulnerability. If successful, Cross-Site Scripting can be exploited to manipulate or steal cookies, create requests that can be mistaken for those of a valid user, compromise confidential information, or execute malicious code on end user systems. Updates which resolve this vulnerability have been announced. Contact the vendor for further details.

 

http://www.securityfocus.com/bid/41925

 

3) SAP J2EE Engine Core Unspecified Cross-Site Scripting Vulnerability

 

SAP J2EE Engine Core is susceptible to a Cross-Site Scripting vulnerability. An attacker can leverage these issues to execute script code in the browsers of unsuspecting users in context of the affected application, possibly leading to theft of authentication credentials and other attacks. Updates which resolve this vulnerability are available. Contact the vendor for more information.

 

http://www.securityfocus.com/bid/41805

 

4) TYPO3 Core TYPO3-SA-2010-012 Multiple Vulnerabilities

 

TYPO3 is susceptible to multiple remote vulnerabilities including Cross-Site Scripting, SQL Injection, HTML Injection, information disclosure, and authentication bypass, among others. If exploited, these vulnerabilities could lead to compromise of the application, the theft of confidential information and authentication credentials, or execution of malicious scripts in the browsers of unsuspecting users. Updates which resolve these vulnerabilities are available. Contact the vendor for additional details.

 

http://www.securityfocus.com/bid/42029

 

5) Cisco CDS Internet Streamer Web Server Directory Traversal Vulnerability

 

The Cisco CDS Internet Streamer webserver component is susceptible to a Directory Traversal vulnerability. Successful exploitation would give an attacker access to sensitive information which could likely be utilized in conducting more damaging attacks. Updates which resolve this vulnerability have been released. Contact the vendor for further details.

 

http://www.securityfocus.com/bid/41846

Search
Showing results for 
Search instead for 
Do you mean 
About the Author(s)
HP Blog

HP Software Solutions Blog

Featured


Follow Us
Labels
The opinions expressed above are the personal opinions of the authors, not of HP. By using this site, you accept the Terms of Use and Rules of Participation.