Nexpose  release announcements - January-March 2012

Document created by kelly_shortt Employee on Feb 7, 2013Last modified by kelly_shortt Employee on Feb 8, 2013
Version 2Show Document
  • View in full screen mode

Rapid7January-March 2012
                  Release announcements

 

 

To help you protect your environment against ever-evolving security threats Rapid7 releases coverage updates on a bi-monthly basis in 2012. This page contains detailed announcements for the January, February and March 2012 Nexpose releases:

 

 

For information on previous coverage releases go to Nexpose Community Release Notes.

For information on the most recent full-feature release go to that Nexpose release announcement.

For details about restarting Nexpose after updating and other update information, see Nexpose release FAQ.

 


This Rapid7® Nexpose® 5.2.1 release contains the following updates:  

 

These release notes document what's new in this Nexpose release. Your Nexpose installation will automatically download and install content updates. If you have enabled Nexpose to install product updates, it will do so as well. .

 

Accuracy improvements | product

Accuracy improvements help you prioritize remediation efforts more effectively.

  • The CVSS score for operating system command injection has been increased to provide a more accurate risk calculation.
  • Enhanced cross-site scripting payloads and patterns reduce false positives generated in scans of specific or rare Web applications.

Coverage improvements | product

  

The following new and updated vulnerability checks have been added to expand your security coverage:

      
  • A vulnerability check for improperly secured WebDAV servers now properly concludes.
  • The Symantec Endpoint Protection DAT version is now detected and reported in the software listing for all systems running SEP.
  

Web spider improvements | product 

  • The Web spider collects more target information when identifying a vulnerability by sending specially crafted strings. This helps you reproduce and remediate the vulnerability more efficiently.
  • The Web spider handles 404 URLs more efficiently to reduce scan times for most Web applications.
  • The Web spider is now able to identify code injection vulnerabilities in multiple operating systems and development languages. This improvement adds coverage for OWASP's A1 vulnerabilities.
          

Coverage improvements | content 

The following new and updated vulnerability checks have been added to expand your security coverage:

      
  • Adobe AIR
  • Google Chrome running on Linux, Microsoft Windows, and Apple OS X. This improvement requires the most recent product update.
  • Microsoft Silverlight for Apple OS X targets. This improvement requires the most recent product update.

Bi-monthly vulnerability check update | content               

  

New vulnerability and patch checks bring coverage up to date for the following operating systems and applications:

  • Adobe
    • AIR
    • Flash
    • Reader
    • Shockwave
  • Apache
  • Apple
    • iTunes
    • Java
    • OS X
    • QuickTime
    • Safari
  • BIND
  • CentOS
  • Cisco devices
  • IBM AIX
  • Java Runtime Environment
  • Mozilla
    • Firefox
    • SeaMonkey
    • Thunderbird
  • OpenSSL
  • Oracle Linux
  • PHP
  • Red Hat Enterprise Linux
  • Solaris
  • VMware

These checks help prevent security breaches that could allow hostile parties to take control of affected systems, gain access to confidential data, disrupt business operations, or cause other problems.

          

Product Update IDs                 

  • Linux 32 | Update ID: 3156269501
  • Linux 64 | Update ID: 1123257707
  • Windows 32 |Update ID: 1096039403
  • Windows 64| Update ID: 2994291181
          

Content update IDs

  • Update ID: 2985068645
    

Installers

  Released on March 21, 2012 (see the fourth FAQ).       

md5sum files 

Download the appropriate md5sum file to ensure that the installer was not corrupted during download:    

 

<go to top>


 

This Rapid7® Nexpose® 5.2  release includes new features and improvements for security configuration assessment, reporting, virtualization support, usability, and administration.
                 
These release notes document what's new in this Nexpose release. Your Nexpose installation will automatically download and install content updates. If you have enabled Nexpose to install product updates, it will do so as well. See the third FAQ.

 

Thanks for choosing Nexpose!
    

Release  5.2 is the next of many exciting deliveries in 2012 in response to your direct  feedback. It incorporates the full commitment of Rapid7 to delivering a great  product to you, our customer. The release focuses on a number of enhancements  for security configuration assessment, reporting, virtualization security,  usability, and administrative capabilities. In terms of coverage, we released checks  for more than 4900 vulnerabilities since the 5.1 release. We trust that you’ll  find these enhancements useful. Keep an eye out for continued enhancements  throughout 2012, and as always, please keep the feedback coming on how we can  make Nexpose even better.
 
Sincerely,

Eric Reiners
Director of Engineering, Rapid7


Security Configuration Assessment | product
               

Expanded  security configuration assessment features give you drill-down capabilities

You can use the Policies dashboard in the Web interface to assess security configuration compliance for your entire environment and then drill down to view compliance results for specific security policies and their elements available in the Advanced Policy Engine. This allows you to determine quickly which assets need to be remediated or which rules are presenting specific compliance issues, so that you can gain insight into your overall compliance posture and risk.
 
NOTE: Your  license must enable the Advanced Policy Engine in order for the Policies dashboard to be visible. To  discuss pricing and upgrade options, please contact Rapid7.


Reporting | product     

Create  custom CSV export reports

With expanded report template capabilities, you can now create custom comma-separated-value (CSV) export reports for better remediation. Choose from more than 30 fields to determine the exact, granular vulnerability information that you want to share with stakeholders in your organization. You can manipulate the exported CSV files with pivot tables to produce multiple views of your vulnerability data. You will find this feature in the report template configuration panel in the Web interface.

NOTE: Customizable CSV Export is only available in Nexpose Enterprise Edition and Nexpose Consultant Edition. To upgrade to one of these editions, please contact Rapid7.

As part of CSV report enhancements, the contents of some of the existing columns have been updated to conform to commonly used CSV-escaping practices.

 

New XML Export includes new attributes

The new  XML Export 2.0 report format includes new attributes that are also available in the extended CSV export, allowing you to export additional critical data for better reporting and remediation of vulnerabilities:

  • PCI compliance status
  • scan data, including the template used, and the scan ID
  • site and asset data, including asset aliases and user-assigned site importance
  • asset and vulnerability risk
  • vulnerability data
  • exploit and malware exposure information

The legacy XML Export and Simple XML formats have been deprecated. After December 31, 2012, Rapid7 will discontinue development and bug fixes for these formats in Nexpose.

For more information see the Report_XML_Export_Schema_2.0, which you can download from the Support page in the Web interface.

 

Vulnerability filtering makes reports more granular

When adding assets to the scope of a report, you can filter what vulnerabilities you will display for those assets to make the report more granular. For example, you may want to report on only critical vulnerabilities, or you may want to filter out potential vulnerabilities.


Virtualization  security | product
    

vAsset management expands with more granular searches and API integration

Using the asset search filter functionality, you can now  search for assets based on virtualization metadata. Creating dynamic asset  groups for virtual assets based on specific criteria can be useful for  analyzing different segments of your virtual environment. For example, you may  want to run reports or assess risk for all the virtual assets used by your  accounting department, and they are all supported by a specific resource pool.  New search filters are:

  • vAsset host
  • resource pool
  • power state
  • datacenter
  • cluster

Additionally, you can now configure virtual asset  connections through the API v1.2. For more information, download the API v1.2  guide from the Support page in the  Web interface.


NOTE: vAsset discovery is only available in Nexpose Enterprise Edition and Nexpose Consultant Edition. To upgrade to one of these editions, please contact Rapid7.


Usability | product
    

Create dynamic asset groups for fingerprinted and non-fingerprinted assets

When performing filtered asset searches based on operating  system, you can use two new  operators (is empty and is not empty) to easily find assets with  and without operating system fingerprints. This allows you to create dynamic  asset groups for fingerprinted and non-fingerprinted assets. These new  operators are also useful for finding assets for which scan authentication may  have failed. For more information, download  the user's guide from the Support page in the Web interface.

Site-specific vulnerability exceptions provide more flexibility

You can now create an exception for all instances of a  vulnerability in a site. Using this scope option, you can exclude all  vulnerabilities that share a site-specific compensating control, such as location  of all assets behind a firewall.

Additionally, when you create any vulnerability exception,  all applicable scope options are now visible, giving you more flexibility when  excluding vulnerabilities from reports or risk score calculations.

 

New browsers supported

Support for new browsers expands your options for using the  Security Console Web interface:

  • Microsoft Internet Explorer 9
  • Mozilla Firefox 10
  • Google Chrome 16 and 17

After December 31, 2012, Rapid7 will discontinue development and bug fixes in Nexpose for the following browsers:

  • Internet Explorer 7
  • Firefox 3.5 and 3.6


Administration | product   

  • You can now specify ticket encryptions for  greater control of Kerberos user authentication.
  • Improvements to logging files make it easier  for you to troubleshoot and debug Security Console and Scan Engine activity:
    • The log file format is more readable.
    • Log files are consolidated into a single  directory.
    • More diagnostic information is included in the  logs that are sent to Technical Support.
    • Unnecessary log messages are reduced.
    • Limits to log file size prevent old log data  from consuming disk space unnecessarily.
    • Log files are consistently archived to their  file size limit.
    • Log messages configured for standard output  display timestamps in the time zone local to the Security Console or Scan  Engine installation.

For information on working with Keberos authentication and log files, download  the administrator's guide from the Support page in the Web interface.


Other improvements and corrected defects | product

  • A Web scanning issue has been resolved so that  scans no longer run for an extremely long time when encountering a service  other than HTTP on port 80.
  • Graphic-rich reports, such as PCI reports, are  generated faster.
  • The drop-down list for Scan Engine send logs now  lists Scan Engines in alphabetical order, making it easier for you to find  which engines to send logs for.
  • An improved detection method reduces potential  false positives for the vulnerability announced in Microsoft Advisory MS10-070.
  • Improved tracking of the backup process provides  you with better alerts for errors that can occur in the process, such as lack  of disk space.
  • A number of improvements in the reporting  framework prevent out-of-memory errors associated with generating and  downloading of large reports.
  • The fingerprinting of services that use H.323  protocol no longer causes some scans to hang.
  • An issue in which the applying of a new license  could disrupt Security Console-to-Scan Engine connections has been corrected.

 

Update improvements | product                

Security Consoles can now receive new built-in policy benchmarks for which they are licensed via content-only updates.


Security content updates since 5.1   

  • We have released checks for more than 4900 vulnerabilities since the 5.1 release.
  • Bi-monthly vulnerability check updates now also include: Adobe, Apache, Apple, BIND, CentOS, Cisco devices, IBM AIX, Java  Runtime Environment, Mozilla, OpenSSL, Oracle Linux, PHP, Red Hat Enterprise  Linux, Solaris, and VMware.
  • Since the 5.1 release, new or expanded  vulnerability checks have been created for Microsoft Office products on Mac OS X, Mozilla Thunderbird, and Mozilla  SeaMonkey.
  • Nexpose now performs more than 85,100  checks for more than 27,700 vulnerabilities.

 

Product update IDs
               

  • Linux 32 | Update ID: 3036809376
  • Linux 64 | Update ID: 2204996165
  • Windows 32 | Update ID: 212730562
  • Windows 64 | Update ID: 896847687
                  

Content update IDs    

  • Update ID: 1723771527
  

Installers    

  Released on March 21, 2012.    

md5sum files
                 

  Download the appropriate md5sum file to ensure that the installer was not corrupted during download:  

 

<go to top>


This Rapid7® Nexpose® 5.1.6 release contains the following updates:

  • Patch Tuesday vulnerability checks
  • improvements to fingerprinting
  • improvements to Web spidering
  • improvements to coverage
  • vulnerability check updates

 

These release notes document what's new in this Nexpose release. Your Nexpose installation will automatically download and install content updates. If you have enabled Nexpose to install product updates, it will do so as well. See the third FAQ.

 

Vulnerability checks for March 2012 Patch Tuesday exposures

New  vulnerability checks provide up-to-date Microsoft Patch Tuesday scan coverage for March 2012. For information about all current security bulletins covered in this release, see the Microsoft Security Bulletin Summary for March 2012. Use the checks in this content update to verify that the latest Microsoft patches have been applied to system assets.

 

Fingerprinting improvements | product

Fingerprinting improvements help you track assets better, provide a more comprehensive software inventory, and present more accurate information on vulnerabilities.  

  • The accuracy of fingerprinting Microsoft Office products on Mac OS X has been improved.
  • Fingerprinting for Mozilla SeaMonkey, Thunderbird, Camino, and Firefox on Mac OS X now functions properly.
  

Web spider improvements | product

Web spider improvements reduce scan times, increase accuracy, and allow form authentication to work as expected.      

  • Enhanced detection of session time-outs and log outs improve the Web spider's session handling capabilities.

Coverage improvements | content

New vulnerability checks for Microsoft Office products on Mac OS X have been added to provide better security coverage.

                    

Bi-monthly vulnerability check update | content               

New vulnerability and patch checks bring coverage up to date for the following operating systems and applications:

  • Adobe
    • Flash
    • Reader
    • Shockwave
  • Apache
  • Apple
    • iTunes
    • Java
    • OS X
    • QuickTime
    • Safari
  • BIND
  • CentOS
  • Cisco devices
  • IBM AIX
  • Java Runtime Environment
  • Mozilla
    • Firefox
    • SeaMonkey
    • Thunderbird
  • OpenSSL
  • Oracle Linux
  • PHP
  • Red Hat Enterprise Linux
  • Solaris
  • VMware

These checks help prevent security breaches that could allow hostile parties to take control of affected systems, gain access to confidential data, disrupt business operations, or cause other problems.

          

Product update

  • Linux 32 | Update ID: 1186913322
  • Linux 64 | Update ID: 2168683604
  • Windows 32 |Update ID: 3274060622
  • Windows 64| Update ID: 4056756512
                    

Content update

  • Update ID: 1358514263

 

<go to top>


This Rapid7® Nexpose® 5.1.5 release corrects a fingerprinting issue.

                    

These release notes document what's new in this Nexpose release. Your Nexpose installation will automatically download and install product updates. If you have enabled Nexpose to install product updates, it will do so. See the third FAQ.


Fingerprinting correction | product

H.323 fingerprinting has been removed to ensure that the Scan Engine will not time out while running scans.

Product update

                      
  • Linux 32      | Update ID: 2854226401                      
  • Linux 64      | Update ID: 3938770832                
  • Windows 32  | Update ID: 1374542599                
  • Windows 64  | Update ID: 407233610
                                    

Installers

  Released on January 23, 2012 (see the fourth FAQ).        

md5sum files

Download the appropriate md5sum file to ensure that the installer was not corrupted during download:        

 

<go to top>


This Rapid7® Nexpose® 5.1.4 release corrects a scan management issue.

                          

These release notes document what's new in this Nexpose release. Your Nexpose installation will automatically download and install content updates. If you have enabled Nexpose to install product updates, it will do so as well. .

 

Scan management correction | product             

This update corrects an issue that affects the running of scans with incremental results integration enabled. The issue could limit scan management functionality in the Web interface, such as for viewing current scan listings.

    

Product update                          

  • Linux 32 | Update ID: 466344278
  • Linux 64 | Update ID: 915363564
  • Windows 32 |Update ID: 3962305119
  • Windows 64| Update ID: 358779393
    

Installers
      

  Released on January 23, 2012 (see the fourth FAQ).         

md5sum files
      

Download the appropriate md5sum file to ensure that the installer was not corrupted during download:      

 

<go to top>


This Rapid7® Nexpose® 5.1.3 release contains the following updates:      

  • new and updated vulnerability checks
  • improvements to Web spidering
  • improvements to fingerprinting and coverage

 

These release notes document what's new in this Nexpose release. Your Nexpose installation will automatically download and install content updates. If you have enabled Nexpose to install product updates, it will do so as well. See the third FAQ.

 

Fingerprinting improvements | product
      

Fingerprinting improvements help you track assets better, provide a more comprehensive software inventory, and present more accurate information on vulnerabilities.      

  • Microsoft Visual Studio is now fingerprinted.
  • VMWare ESXi versions are now fingerprinted more accurately.
  • H.323 devices are now fingerprinted.

 

Web spider improvements | product
        

Web spider improvements reduce scan times, increase accuracy, and allow form authentication to work as expected.  

  • The Web spider now gives priority to scanning user-defined bootstrap paths to ensure that they are scanned before Web spider performance limits are reached.
  • Link extraction and soft 404 response identification have been enhanced.
  • Web spider proofs, where applicable, have been expanded to contain the HTTP request method used to determine the presence of the vulnerability alongside the path.
  • Local-file-include vulnerabilities, as discovered by the Web spider, are now leveraged as a source to find additional vulnerabilities on the target Web server.

 

Coverage improvements | content      

Vulnerability checks for Mozilla Thunderbird have been added to expand your security coverage.

    

Bi-monthly vulnerability check update | content
    

New vulnerability and patch checks bring coverage up to date for the following operating systems and applications:    

  • Adobe
    • Flash
    • Reader
    • Shockwave
  • Apache
  • Apple
    • iTunes
    • Java
    • OS X
    • QuickTime
    • Safari
  • BIND
  • CentOS
  • Cisco devices
  • IBM AIX
  • Java Runtime Environment
  • Mozilla
    • Firefox
    • SeaMonkey
    • Thunderbird
  • OpenSSL
  • Oracle Linux
  • PHP
  • Red Hat Enterprise Linux
  • Solaris
  • VMware

 

These checks help prevent security breaches that could allow hostile parties to take control of affected systems, gain access to confidential data, disrupt business operations, or cause other problems.

Product update
      

  • Linux 32| Update ID: 3572341050
  • Linux 64| Update ID: 640666307
  • Windows 32| Update ID: 180344023
  • Windows 64| Update ID: 1404853366

 

Content update      

  • Update ID: 2995854475

 

Installers
      

Released on January 23, 2012 (see the fourth FAQ).      

 

md5sum files
      

Download the appropriate md5sum file to ensure that the installer was not corrupted during download:      

 

<go to top>


This Rapid7® Nexpose® 5.1.2 release applies checks for Patch Tuesday exposures and features new and updated vulnerability checks and improvements to Web spidering, fingerprinting, and scanning.

 

These release notes document what's new in this Nexpose release. Your Nexpose installation will automatically download and install content updates. If you have enabled Nexpose to install product updates, it will do so as well. See the third FAQ.

 

Fingerprinting improvements | product    

  

Fingerprinting improvements help you track assets better, provide a more comprehensive software inventory, and present more accurate information on vulnerabilities.

      
  • Improved fingerprinting of the Oracle listener ensures that non-Oracle listener services are no longer fingerprinted as Oracle.
  • NetBus version 2.0 is now more accurately fingerprinted. Specifically certain non-NetBus services are no longer fingerprinted as NetBus.
  • Microsoft Anti-Cross Site Scripting Library is now fingerprinted.

Scanning improvement | product

SSH client support has been improved for SSH servers with unexpected authentication requirements to enhance detection and reporting of vulnerabilities.

            

Web spider improvements | product      

    

Web spider improvements reduce scan times, increase accuracy, and allow form authentication to work as expected.

      
  • Improved link extraction by the URL parser reduces the amount of incorrect redirect requests.
  • Vulnerability reporting of the HTTPOnly flag for HTTP cookies has been improved.
                                                  

Coverage improvements | content      

  

Vulnerability checks for Mozilla SeaMonkey have been added to expand your security coverage.

    

February 2012 Patch Tuesday checks | content      

    

New vulnerability checks provide up-to-date Microsoft Patch Tuesday scan coverage for February 2012. For information about all current security bulletins covered in this release, see the Microsoft Security Bulletin Summary for February 2012. Use the checks in this update to verify that the latest Microsoft patches have been applied to system assets.

                            

Bi-monthly vulnerability check update | content      

    

New vulnerability and patch checks bring coverage up to date for the following operating systems and applications:

      
  • Adobe
    • Flash
    • Reader
    • Shockwave
  • Apache
  • Apple
    • iTunes
    • Java
    • OS X
    • QuickTime
    • Safari
  • BIND
  • CentOS
  • Cisco devices
  • IBM AIX
  • Java Runtime Environment
  • Mozilla
    • Firefox
    • SeaMonkey
  • OpenSSL
  • PHP
  • Red Hat Enterprise Linux
  • Solaris
  • VMware
  

These checks help prevent security breaches that could allow hostile parties to take control of affected systems, gain access to confidential data, disrupt business operations, or cause other problems.

                      

Product update      

      
  •   Linux 32 | Update ID: 2185736893
  •   Linux 64 | Update ID: 847937182
  •   Windows 32|Update ID: 2248718861
  •   Windows 64| Update ID: 3756983199
  

Content update      

        
  • Update ID: 3386140463

 

Installers      

  Released on January 23, 2012 (see fourth FAQ).         

md5sum files      

Download the appropriate md5sum file to ensure that the installer was not corrupted during download:        

 

<go to top>


This Rapid7® Nexpose® 5.1.1 release  features new and updated vulnerability checks and improvements to Web spidering, coverage, and fingerprinting.
                 
These release notes document what's new in this Nexpose release. Your Nexpose installation will automatically download and install content updates. If you have enabled Nexpose to install product updates, it will do so as well. See the third FAQ.

 

Fingerprinting improvements | product
    

    

Fingerprinting improvements helps you track assets better, provide a more comprehensive software inventory, and present more accurate information on vulnerabilities.

      
  • Improved Fingerprinting for Oracle Java, Adobe Flash and Microsoft Office on Mac OS X.
  • The version of Cisco Internetwork Operating System (IOS) is now correctly fingerprinted in all cases.

Scanning improvement | product

Improved detection for the vulnerability announced in Microsoft Security Bulletin MS10-070 reduces potential false positives.

 

                

Web spidering improvements | product      

      
  • Persistent cross-site scripting detection has been improved for SQL injection flaws and for certain Web scanning configurations.
  • Vulnerability reporting of the HTTPOnly flag for HTTP cookies has been improved.
  • Scan times have been improved on target services other than HTTP on port 80.
                                                  

Coverage improvements | content      

    

New checks for Java and Adobe Flash on Mac OS X expand security coverage.

 

Fingerprinting improvement | content      

    

Adobe Flash Player is now fingerprinted on non-Windows platforms to help you track assets better, provide a more comprehensive software inventory, and present more accurate information on vulnerabilities.

                              

Bi-monthly vulnerability check update | content               

      

New vulnerability and patch checks bring coverage up to date for the following operating systems and applications:

      
  • Adobe
    • Flash
    • Reader
    • Shockwave
  • Apache
  • Apple
    • iTunes
    • Java
    • OS X
    • QuickTime
    • Safari
  • BIND
  • CentOS
  • Cisco devices
  • IBM AIX
  • Java Runtime Environment
  • Mozilla Firefox
  • OpenSSL
  • PHP
  • Red Hat Enterprise Linux
  • Solaris
  • VMware
  

These checks help prevent security breaches that could allow hostile parties to take control of affected systems, gain access to confidential data, disrupt business operations, or cause other problems.

                      

Product update      

      
  • Linux 32                        | Update ID: 907924255
  • Linux 64                        | Update ID: 3322072356
  • Windows 32                    |Update ID: 4038596404
  • Windows 64                    | Update ID: 1683549019
  

Content update                

      
  • Update ID: 3005745968

 

Installers      

  Released on January 23, 2012 (see fourth FAQ).         

md5sum files      

Download the appropriate md5sum file to ensure that the installer was not corrupted during download:      

 

<go to top>


This Rapid7® Nexpose® 5.1  release features improvements to security configuation assessment, Web application security, scanning and documentation, and expanded virtualization support.

 

These release notes document what's new in this Nexpose release. Your Nexpose installation will automatically download and install content updates. If you have enabled Nexpose to install product updates, it will do so as well. .

 

Thanks for choosing Nexpose!
      

Release 5.1 is one of many exciting deliveries in 2012 in response to your direct feedback. It incorporates the full commitment of Rapid7 to delivering a great product to you, our customer. The release includes improved asset searches and reporting with our new, extended Dynamic Asset Group criteria. If you are using Advanced Policy Engine for security configuration assessment, we now provide USGCB support as well as a high-level overview of your policy compliance across your organization. For those of you looking to migrate to newer platforms we have enhanced the backup-and-restore feature to allow cross-platform migration in addition to a smaller footprint of backup files. In terms of coverage, we rounded out our checks for the OWASP Top 10, released more than 3400 checks since the 5.0 release, and improved accuracy of our SSH vulnerability checks. We trust that you’ll find these enhancements useful. Keep an eye out for continued enhancements throughout 2012, and as always, please keep the feedback coming on how we can make Nexpose even better.
 
Sincerely,

Eric Reiners
Director of Engineering, Rapid7

 

Security Configuration Assessment | product and content
                 

USGCB scanning helps you keep current with government standards

With the new, fully integrated USGCB scan template, you can scan your Windows 7, Windows 7 Firewall, Windows 7 Energy, and Internet Explorer 8 assets to verify compliance with the United States Government Configuration Baseline (USGCB). Informed by the results of policy scans, you can make any necessary configuration changes to ensure that your assets comply with USGCB standards. To create a scan configuration that matches the specific needs of your environment, you can customize scan templates with USGCB checks, which are included in the Advanced Policy Engine. As with Federal Desktop Core Configuration (FDCC) checks, you can view and override USGCB results in the Web interface.

To help you further to comply with U.S. government requirements, this feature also allows you to generate USGCB Result Files and output their content in a machine-readable format for submission to the Office of Management and Budget.

NOTE: The USGCB scan template is bundled with the FDCC module and sold as a separately licensable option. This module requires the Advanced Policy Engine to be enabled. To discuss pricing and upgrade options, please contact Rapid7.

 

Security configuration assessment at a glance

The new Policies tab provides a centralized view of your assets’ compliance with key security policies and baselines for which you have run scans. On the new Policies page you can get a quick overview of your assets’ compliance with Advanced Policy Engine policies and baselines for which you have run scans. The page shows compliance statistics at the policy level to help you quickly gauge compliance across your entire organization.

 

Web application security | product and content       

  

Nexpose now delivers coverage in all 10 of the OWASP Top 10 Security Risk categories

New checks identify "Failure to Restrict URL Access" vulnerabilities, which make up the A8 category of the Open Web Application Security Project  (OWASP) Top 10 Security Risks for Web applications. With this improvement, the Web scanner now identifies vulnerabilities in each of the Top 10 OWASP categories. You can find more information about the category here:
https://www.owasp.org/index.php/Top_10_2010-A8-Failure_to_Restrict_URL_Access
   
NOTE: These checks require HTTP form or HTTP basic credentials in the site configuration.

  

Web crawling is improved | product

With enhanced crawling capabilities, the Web scanner can identify more links in complex Web applications.

           

Scanning improvements | product and content                 

"Pass-the-hash” credential expands deep scanning options

You can now use captured LM/NTLM hashes for running credentialed scans on Windows assets via the standard SMB/CIFS protocol. Expanding your range of deep scanning options, this credential makes it unnecessary to “crack the password” to gain access to target services.

Penetration testers who use Metasploit can leverage this feature by launching a Nexpose scan task and checking the Pass the LM/NTLM hash credentials checkbox. Metasploit will then automatically pass to Nexpose any LM/NTLM hashes that it looted during exploitation, allowing Nexpose to perform fully authenticated scans.

 

SSH checks have improved accuracy

Better SSH negotiation eliminates false positives on scan target services that utilize an authentication mechanism after the negotiation.

 

Coverage and reporting improvements

             
  • Improved checks for vulnerabilities reported in Microsoft Security Bulletin MS10-070 provide better security coverage.
             
  • Baseline comparison reports are now generated without issues when an asset is included in the report scope by more than one scope selection mechanism: asset, asset group, or site.
                 

Virtualization support | product
                 

Options expand for vAsset discovery connections

You can now specify any port and protocol (HTTPS or HTTP) for communicating with vSphere instances when establishing  vConnections for vAsset discovery.

Connection columns improve vAsset monitoring

The vEvents table, which lists every change in the vAsset discovery environment, now includes the vConnection associated with each event, so that you can determine which assets and events are associated with each vCenter server or ESX(i) host.

 

Usability and Administrative Enhancements | product
                 

New dynamic filters provide more granular asset searches

The dynamic asset group filter capabilities have been greatly expanded. You can now create dynamic asset groups based on risk scores, exploit and malware exposures, CVSS metrics, PCI scan results, and scan dates.  These enhanced searching capabilities provide more granular ways to isolate assets that affect your security posture in critical ways and prioritize them for remediation. 

Filtered Asset Search panel

New asset column shows number of malware kits

Asset Listing tables in the Web interface now include a column that lists the number of malware kits that can be used to exploit vulnerabilities on each asset. Viewing the number of malware exposures and sorting on them can help you prioritize remediation tasks.

 

Platform-independent backups allow migration to newer platforms
(aka 32-bit to 64-bit migration)

When performing backups, you can select a platform-independent option that gives you the flexibility to restore the files on any host system, whether or not it has the same operating system as the host for the backup.  This option also reduces the size of the backup file.

NOTE: Platform-independent backups may take longer to complete.

 

Other usability enhancements

      
  • The navigation tabs in the Web interface are ordered to better match your workflow.
  •   
  • You can create a CSV file listing all of the threats associated with an asset.
  •       

Documentation improvements | product                  

Expanded user’s guide provides more detailed information on reports

The user’s guide now includes more detailed information and best practices for generating and reading reports and using the CSV export. You can download the guide by clicking the Support link in the Web interface.

                                                 

Product update      

               
  • Linux 32                    | Update ID: 2220601069
  • Linux 64                    | Update ID: 839270008
  • Windows 32                | Update ID: 1220461598
  • Windows 64                | Update ID: 3456844061
           

Content update      

  • Update ID: 1799734434

 

Installers      

  Released on January 23, 2012 (see fourth FAQ).                           

md5sum files      

Download the appropriate md5sum file to ensure that the installer was not corrupted during download:               

 

<go to top>


This Rapid7® Nexpose® 5.0.5 release applies checks for Patch Tuesday exposures and features new and updated vulnerability checks and improvements to Web spidering  and fingerprinting. 
These release notes document what's new in this Nexpose release. Your Nexpose installation will automatically download and install content updates. If you have enabled Nexpose to install product updates, it will do so as well. See the third FAQ.

 

Fingerprinting improvements | product    

    

Fingerprinting improvements helps you track assets better, provide a more comprehensive software inventory, and present more accurate information on vulnerabilities.

    
  • Apple iTunes is now fingerprinted on Apple OS X and Microsoft Windows hosts.
  • Apple Safari is now fingerprinted on Apple OS X and Microsoft Windows hosts.
  • Apple OS X versions are now more accurately fingerprinted over Post Office Protocol (POP).
  

Web spidering improvement | product      

The Web spider honors configured scan time limits when the target server connection has timed out.

                                        

Coverage improvement | content      

    

New vulnerability checks for Apple iTunes and Safari provide better security coverage. This improvement requires the most recent product update.

 

January 2012 Patch Tuesday checks | content      

    

New vulnerability checks provide up-to-date Microsoft Patch Tuesday scan coverage for January 2012. For information about all current security bulletins covered in this release, see the Microsoft Security Bulletin Summary for January 2012. Use the checks in this update to verify that the latest Microsoft patches have been applied to system assets.

  

Bi-monthly vulnerability check update | content    

      

New vulnerability and patch checks bring coverage up to date for the following operating systems and applications:

    
  • Adobe
    • Flash
    • Reader
    • Shockwave
  • Apache
  • Apple
    • iTunes
    • OS X
    • Quicktime
    • Safari
  • BIND
  • CentOS
  • Cisco devices
  • IBM AIX
  • Java Runtime Environment
  • Mozilla Firefox
  • OpenSSL
  • PHP
  • Red Hat Enterprise Linux
  • Solaris
  • VMware
  

These checks help prevent security breaches that could allow hostile parties to take control of affected systems, gain access to confidential data, disrupt business operations, or cause other problems.

                      

Product update      

    
  •   Linux 32                      | Update ID: 1131559202
  •   Linux 64                      | Update ID:  1877157259
  •   Windows 32                    | Update ID:      1824046400
  •   Windows 64                    1875815400             
             

Content update      

               
  • Update ID: 1538017521
 

Installers      

Released on November 17, 2011 (see fourth FAQ).                             

md5sum files      

Download the appropriate md5sum file to ensure that the installer was not corrupted during download:               

 

<go to top>


Attachments

    Outcomes