hp-security-research-cyber-risk-report-pdf-2-w-1408

HP Security Research | Cyber Risk Report 2015Many corporations are unaware ofthe risk imposed on them by usingpoorly codedmiddleware and IT managementapplications.Weaknesses in enterprise middlewareCorporations are embracing software as a service (SaaS) and other middleware solutions toshorten the time it takes to deliver business applications. These applications contain copiousamounts of sensitive corporate data and personally identifiable information. Middlewareapplications rely heavily on protocols such as HTTP, Simple Object Access Protocol (SOAP), andJSON to communicate with each other. Most of these communication protocols are exposed tothe network and are accessible without authentication. The attack surface exposed by theseapplications can be large and riddled with weaknesses.These services have become an increasingly popular target for researchers and the numberof vulnerabilities discovered in 2014 was astonishing. The HP Zero Day Initiative worked withnumerous middleware and IT management software vendors to shore up their code. In fact,during just one week, a single researcher submitted over 40 remotely exploitable vulnerabilitiesin ManageEngine’s product line. These vulnerabilities ranged from information disclosure issuesto denial of service conditions and remote code execution vulnerabilities.To highlight the ease with which these issues could be exploited, this Report takes a deeperlook at one of the resolved information disclosure issues. CVE-2014-8678 (ZDI-14-386 54 )was a vulnerability in the ManageEngine OpUtils ConfigSaveServlet servlet. This vulnerabilityallowed remote attackers to disclose files on vulnerable installations of ManageEngine OpUtils.Authentication was not required to exploit this vulnerability.The issue lies in the failure to properly sanitize the saveFile parameter for directory traversalcharacters. A remote attacker can exploit this vulnerability to disclose files from the system.Using directory traversal, an attacker can easily disclose sensitive information residing on theserver running ManageEngine OpUtils. The impact of this attack can be visualized further byunderstanding the type of data handled by the OpUtils software. According to ManageEngine,OpUtils helps network engineers manage their switches and IP address space. 55 Specifically,OpUtils would have details about a corporation’s IPv4 and IPv6 subnets, backups ofconfiguration files of Cisco routers and switches, and bandwidth usage statistics. It’s possiblefor an attacker to leverage the vulnerability to disclose this valuable information to aid themin future attacks. Many corporations are unaware of the risk imposed on them by using poorlycoded middleware and IT management applications. Updates to these applications should beapplied as soon as they are available to reduce exposure.Vulnerability and exploits trends in 2014 (Windows case)2014 saw Microsoft Internet Explorer, Microsoft Office and Adobe® Flash Player zero days inthe wild. Notably in 2014 there were no major Oracle Java zero days discovered exploited in thewild. This is likely due in part to the click-to-play feature Oracle recently introduced. This sectiontakes a deeper look at the security technologies and how they were bypassed.Defeating ASLR and DEP security protectionsMost of the exploits observed in the wild were successful at defeating ALSR and Data ExecutionPrevention (DEP). DEP, like ASLR, is a security feature. It marks areas of memory as either“executable” or “nonexecutable,” allowing only data in an executable area to be run. DEPprotects against some program errors and helps prevent certain malicious exploits. The abilityto bypass these protections has become a common feature of modern exploits. While manydifferent techniques may be used to defeat these protections, the most popular method is tocorrupt application objects on the heap and change the length field of the object, as seen inthe multitude of Microsoft Internet Explorer UAF exploits. Often surgical precision memorymanipulation is performed resulting in a very high exploit success rate. Object corruption andcode reuse attacks are typical techniques currently used to defeat ASLR and DEP.54http://zerodayinitiative.com/advisories/ZDI-14-386/.55http://www.manageengine.com/products/oputils/ Page 15.15