Nexpose release announcements for May 2016

Document created by Rapid7 Learning Team Employee on May 2, 2016Last modified by Rapid7 Learning Team Employee on May 26, 2016
Version 8Show Document
  • View in full screen mode

To help you protect your environment against ever-evolving security threats, Rapid7 releases coverage updates for Nexpose on a weekly basis. Product IDs and installer links are added the day of the release. This page contains detailed announcements for the most recent Nexpose coverage releases:


This Rapid7® Nexpose® 6.2.12 release includes:


Application enhancements | content & product

Improvements to how the application integrates and presents scan data, and how it performs overall, help you to manage security issues more effectively in your environment:

  • We have addressed an issue loading policy content on startup of Security Console.


Recurring coverage | content

New and updated vulnerability checks help protect your environment against the latest threats. See all the operating systems and applications covered by these updates.

 

Installer links, md5sum links, and virtual appliance links

Click here for the latest installer links, md5sum links, and virtual appliance links.

 

Product Update IDs

  • Linux 64 | Update ID: 656451507
  • Windows 64 | Update ID: 4053216707

 


This Rapid7® Nexpose® 6.2.11 release includes:


Accuracy enhancements | content & product

Better accuracy of scan results helps you to assess your security posture and prioritize remediation more effectively:

  • We have reduced false positives with patched WebLogic 10.x instances no longer flagging vulnerable to CVE-2015-4852.
  • WebLogic and JBoss authenticated fingerprinting now uses the existing file system exclusion system property as opposed to its own hard-coded parameter.
  • We improved WebLogic and JBoss authenticated fingerprinting on Unix systems as well as the accuracy of WebLogic 10.x fingerprinting.
  • We have improved the accuracy of our remote check for DROWN (CVE-2016-0800).


Application enhancements | product

Improvements to how the application integrates and presents scan data, and how it performs overall, help you to manage security issues more effectively in your environment:

  • We have increased the accuracy of scan scoped QualysGuard XML Exports by eliminating duplicate vulnerabilities when an asset is linked to multiple sites.
  • The Rule Breakdown Summary report now displays the correct group name for policy rules when reporting on a custom policy.
  • The Rule Breakdown Summary report now generates data more consistently.
  • Users can now view the Nexpose user interface in Traditional Chinese.


Recurring coverage | content

New and updated vulnerability checks help protect your environment against the latest threats. See all the operating systems and applications covered by these updates.

 

Installer links, md5sum links, and virtual appliance links

Click here for the latest installer links, md5sum links, and virtual appliance links.

 

Product Update IDs

  • Linux 64 | Update ID: 2920454750
  • Windows 64 | Update ID: 2269825961

 


This Rapid7® Nexpose® 6.2.10 release includes:


Accuracy enhancements | content & product

Better accuracy of scan results helps you to assess your security posture and prioritize remediation more effectively:

  • Accuracy for detecting MS16-019 has been enhanced.
  • New Center for Internet Security (CIS) policy now provides compliance coverage for VMware ESXi 5.5.


Application enhancements | product

Improvements to how the application integrates and presents scan data, and how it performs overall, help you to manage security issues more effectively in your environment:

  • We have changed the behavior associated with a session time out while viewing a PDF report rendered in the browser. You will now be redirected to the report after logging in instead of the homepage.

Issue coverage | content & product

The following IS numbers have been addressed in this release:

  • IS-6876, IS-6801, IS-6867, IS-6931, IS-6948, IS-6921.


Recurring coverage | content

New and updated vulnerability checks help protect your environment against the latest threats. See all the operating systems and applications covered by these updates.

 

Installer links, md5sum links, and virtual appliance links

Click here for the latest installer links, md5sum links, and virtual appliance links.

 

Product Update IDs

  • Linux 64 | Update ID: 1051764363
  • Windows 64 | Update ID: 2198770114

 


This Rapid7® Nexpose® 6.2.9 release includes:


Scanning enhancements | product

Better scan performance helps you to retrieve scan results more quickly with improved accuracy and more efficient use of resources:

  • We have resolved an issue that caused scans to fail when a Windows-based Scan Engine tried to scan itself.


Recurring coverage | content

New and updated vulnerability checks help protect your environment against the latest threats. See all the operating systems and applications covered by these updates.

 

Installer links, md5sum links, and virtual appliance links

Click here for the latest installer links, md5sum links, and virtual appliance links.

 

Product Update IDs

  • Linux 64 | Update ID: 2318155972
  • Windows 64 | Update ID: 1798850468

 


This Rapid7® Nexpose® 6.2.8 release includes:


Coverage for May Patch Tuesday exposures | content

New vulnerability checks provide up-to-date Microsoft Patch Tuesday scan coverage for May 2016. For information about all current security bulletins covered in this release, see the Microsoft Security Bulletin Summary for May 2016. Use the checks in this update to verify that the latest Microsoft patches have been applied to system assets.


Accuracy enhancements | content

Better accuracy of scan results helps you to assess your security posture and prioritize remediation more effectively:

  • We have improved the accuracy of Java JRE vulnerability checks from the April 2016 CPU (CVE-2016-0686, CVE-2016-0687, CVE-2016-0695, CVE-2016-3422, CVE-2016-3425, CVE-2016-3427, CVE-2016-3443, and CVE-2016-3449).


Scanning enhancements | content & product

Better scan performance helps you to retrieve scan results more quickly with improved accuracy and more efficient use of resources:

  • We have improved scan resilience by updating the Shellshock vulnerability checks.


Accuracy enhancements | product

Better accuracy of scan results helps you to assess your security posture and prioritize remediation more effectively:

  • We have reduced occurrence of false positives when checking for Microsoft vulnerabilities. We have resolved an issue associated with supersedence.
  • MySQL service fingerprinting has been improved to provide more accurate version information. Additionally MariaDB is now identified as a separate product, eliminating false positives for MySQL vulnerabilities that do not apply to MariaDB.


Application enhancements | product

Improvements to how the application integrates and presents scan data, and how it performs overall, help you to manage security issues more effectively in your environment:

  • We have fixed an issue that would cause the error message "Unable to determine if blackout exists" to appear when starting adhoc scans on individual assets.
  • We resolved an issue where asset data potentially fails to update during scans, resulting in incorrect categorization and reporting of an asset.
  • We have eliminated unnecessary notification creation when Sonar is inaccessible. Product notifications no longer display an inactive vConnection when Sonar is not accessible to the Security Console.
  • Users with a large number of scan engines will find it easier to locate specific engines when creating shared credentials. We have updated the scan engine drop down menu in the test credentials option within the shared credentials wizard to always sort alphabetically.


Scanning enhancements | product

Better scan performance helps you to retrieve scan results more quickly with improved accuracy and more efficient use of resources:

  • We have improved scan performance in situations where an SSH endpoint does not properly execute commands.

Issue coverage | content & product

The following IS numbers have been addressed in this release:

  • IS-6793, IS-6927, IS-6816, IS-6928, IS-6885, IS-6923, IS-6866, IS-6482, IS-322, IS-6886, IS-6557, IS-6920, IS-6908.

 

Recurring coverage | content

New and updated vulnerability checks help protect your environment against the latest threats. See all the operating systems and applications covered by these updates.

 

Installer links, md5sum links, and virtual appliance links

Click here for the latest installer links, md5sum links, and virtual appliance links.

 

Product Update IDs

  • Linux 64 | Update ID: 778612363
  • Windows 64 | Update ID: 1675080522

 


This Rapid7® Nexpose® 6.2.7 release includes:


Application enhancements | product

Improvements to how the application integrates and presents scan data, and how it performs overall, help you to manage security issues more effectively in your environment:

  • We have addressed an issue that caused scheduled scans set to "restart from beginning" not to restart.


Recurring coverage | content

New and updated vulnerability checks help protect your environment against the latest threats. See all the operating systems and applications covered by these updates.

 

Installer links, md5sum links, and virtual appliance links

Click here for the latest installer links, md5sum links, and virtual appliance links.

 

Product Update IDs

  • Linux 64 | Update ID: 2508556409
  • Windows 64 | Update ID: 3111144308

 


This Rapid7® Nexpose® 6.2.6 release includes:


Accuracy enhancements | content

Better accuracy of scan results helps you to assess your security posture and prioritize remediation more effectively:

  • In order to align with the remediation steps for the rule, the CIS CentOS 6 "Set Default umask for Users" benchmark rule has been modified to check "/etc/bashrc" and "/etc/profile."


Accuracy enhancements | product

Better accuracy of scan results helps you to assess your security posture and prioritize remediation more effectively:

  • We have addressed an issue that could cause SNMPv3 to be incorrectly fingerprinted against non-SNMP endpoints.
  • We have addressed an issue with remote fingerprinting using CIFS where, in some circumstances, newer versions of Samba caused Linux hosts to be fingerprinted as Windows.


Application enhancements | product

Improvements to how the application integrates and presents scan data, and how it performs overall, help you to manage security issues more effectively in your environment:

  • We have improved consistency between XML exports and PDF reports. XML Export 1.0 and 2.0 reports have been updated to include CVE-IDs for vulnerabilities with NVD attributed as the reference source. The reference source will be shown as CVE in the report for backwards compatibility.
  • For better accuracy when working with a large asset pool, the Static Asset Group page can now display several thousand assets.
  • We have resolved an issue that caused duplicate vulnerabilities to appear in the QualysGuard Compatible XML Export Report when an asset was in more than one site.
  • We have addressed an issue that prevented the support package from being generated on Windows systems with more restricted file access permissions.


Scanning enhancements | product

Better scan performance helps you to retrieve scan results more quickly with improved accuracy and more efficient use of resources:

    • We have addressed an issue where potential scan hangs occurred when scanning port 449 on a target.

Issue coverage | content & product

The following IS numbers have been addressed in this release:

  • IS-6523, IS-6519, IS-6750, IS-6870, IS-6883, IS-6787, IS-6391, IS-6884.

 

Recurring coverage | content

New and updated vulnerability checks help protect your environment against the latest threats. See all the operating systems and applications covered by these updates.

 

Installer links, md5sum links, and virtual appliance links

Click here for the latest installer links, md5sum links, and virtual appliance links.

 

Product Update IDs

      • Linux 64 | Update ID: 3574626208
      • Windows 64 | Update ID: 1853431058
1 person found this helpful

Attachments

    Outcomes