Change Log

New Features

• Snare Server 7.4.5 is a patch release that includes bug fixes and operating system security updates.

Enhancements

• When enabled, for systems with 8Gb of RAM or more, the elasticsearch heap size has been upgraded to 4Gb.
• A new "NAS Protocol version" option has been added to Disk Manager.

Bug Fixes

• Removed the duplicate handling of Snare Transition files that may appear when unscheduled server reboots occur.
• Fixed an issue in the data scripts that would leave log files in the /data/SnareTransition partition, in circumstances where an unscheduled server reboot, or a manual service restart interrupted the automatic transition and compression of files.

Security

• Additional protections added around OS executions and SQL sanitisation (CVE-2019-11363 & CVE-2019-11364).

  Thanks to Simone Quatrini, of Pen Test Partners in the UK.

  Inadequate input validation around user and group data could lead to an authenticated administrator-level user of the user interface, to change the meaning of SQL queries directed at resolving pre-stored user/group information.

  Resolution: The target Sanitisation module used by the User/Group query module was incorrect ("small text" rather than "small string"), and the associated "small text" module had only very basic protections. The "small text" and "small string" sanitisation modules have been linked as synonyms as a result of this update. Additional protections have also been included in the generic sanitisation component.

  Inadequate input validation in the "Disk Manager" component of the Snare Server user interface, could allow a logged-in administrative-level user to run a range of root-level commands by crafting specific content in a specific input variable.

  Resolution: Both specific and generic updates have been made to the protections around operating system binary execution to address both this specific issue, and more generic potential threats.

  Note that the reason that the CVSSv3 scores for these issues are comparatively low, is due to the requirement for Administrator-level access to the server, and the fact that the administrator already has authorized root-level access to the underlying operating system and SQL data structures.

Operating System Updates