Release Notes for Snare Central v7.1.3
- Andrew Madge
Snare Central v7.1.3 was released on 8th December 2016
New Features
- New objectives have been added for Palo Alto Networks firewalls. Objectives can be selected using the "Change Objective Type" button in the Objective Configuration window.
- Sample objectives for Palo Alto Networks firewalls, F5 ASM violation logs, Sidewinder firewalls, and Web Server response codes, have been added to the default installation list.
Enhancements
- Increased the maximum values for large queries in the Snare Configuration Wizard under the Performance and Hardware tab. Queries are now allowed to run for up to 600 minutes, and use more than 5 million rows in the report. Use the larger settings with caution as they can result in significant memory usage at both the server end, and within the browser if very large reports are created.
- Additional support for incoming RFC 5424 syslog messages: The collection subsystem will now process messages that do not quite meet the RFC5424 standard, but are close enough to meeting the specification that we can still derive essential details.
- Additional support for collecting data from PaloAlto firewalls.
- Oracle tabular output will now append useful textual representations to the ACTION and PRIVILEGE numbers reported by Oracle. The dynamic query configuration panel will also allow you to select ACTION/PRIV elements by their textual representation.
- Improved handling of TCP/TLS connections. Gracefully shut down TLS connections as per the RFC when the server disconnects the client and deal with some rare TCP cases better where sockets took longer to shutdown than expected.
- For updates specifically from Snare Server v7.1.2 or above, operating system package updates have been rolled back into the normal update process, rather than running as a post-update addendum. Additional feedback on what is being updated, is available to the user updating the system.
Bug Fixes
- The AMC was not handling more complex session tokens that were add in with the 4.3.7 windows agent as they can now include special characters as a result of the increased entropy on the agents session tokens. The AMC now correctly handles session tokens that have special characters in them.
- Fixed a condition in which Snare Collector may terminate at some indeterminate time due to a failed attempt to allocate memory.
- The SnareCollector WebUI released with 7.1.2 was incompatible with the associated PhantomJS web-page imaging software. This caused the charts of Destinations under "Configure Snare Server Collector/Reflector" to not appear. This is now resolved.
- The Syslog RFC-5424 header format is PRI VERSION TIMESTAMP HOSTNAME where HOSTNAME is defined to be either a NILVALUE ("-") or an ASCII string. For example:
<34>1 2003-10-11T22:14:15.003Z mymachine.example.com <34>1 2003-10-11T22:14:15.003Z.
Snare Server will now detect a "-" or invalid/missing hostname and insert the IP address of the source into each event under the following configurations:
1. Syslog RFC5424 input into Snare Server and reflecting to a destination using RFC-3164 format.
2. Syslog RFC3164 input into Snare Server and reflecting to a destination using RFC-5424 format.
Note that Snare Server will not modify the event stream if the incoming format and the destination format are the same (for example RFC-3164 to RFC3164 or RFC-5424 to RFC-5424). - Corrected issue where the creation of the ISO image via Data Backup could not be downloaded after it was created in the System | Data Backup | Data Backup web UI and would show a blank screen. The download process now correctly works and downloads to the browser.
- SMTP port test now works for port numbers other than port 25 as is common for sites that only use SSL or TLS email ports. Additional feedback is available for circumstances where there are problems with email delivery.
- Modifications to the DNS server configuration from either the Snare Server UI, or the console administration menu, will now correctly survive a reboot.
- The file permissions on the TLS server pem file have been strengthened to 600 to be read/write by the root user.
Operating System Updates
| Update | Snare Server Impact | Details |
|---|---|---|
accountsservice has been upgraded from 0.6.35-0ubuntu7.2 to 0.6.35-0ubuntu7.3 libaccountsservice0:amd64 has been upgraded from 0.6.35-0ubuntu7.2 to 0.6.35-0ubuntu7.3 | Minimal | accountsservice (0.6.35-0ubuntu7.3) trusty; urgency=medium
* debian/patches/wtmp-fix-logout.patch: - Backport 0.6.43 commit to fix logout records when a user shuts down or restarts their computer (LP: #1443052) |
apt has been upgraded from 1.0.1ubuntu2.14 to 1.0.1ubuntu2.15 | Nil | |
apt-transport-https has been upgraded from 1.0.1ubuntu2.14 to 1.0.1ubuntu2.15 | Nil | |
apt-utils has been upgraded from 1.0.1ubuntu2.14 to 1.0.1ubuntu2.15 | Nil | |
bind9-host has been upgraded from 1:9.9.5.dfsg-3ubuntu0.8 to 1:9.9.5.dfsg-3ubuntu0.10 | Minimal. The Snare Server does not attempt to resolv DNS entries exter nal to the organisational network boundary, except for the following cases: * When the objective "Import Objectives" is accessed, under direction from the logged-in user, the server will attempt to connect to the InterSect Alliance support site to download additional objectives. | bind9 (1:9.9.5.dfsg-3ubuntu0.10) trusty-security; urgency=medium * SECURITY UPDATE: denial of service via responses containing a DNAME answer |
clamav has been upgraded from 0.98.7+dfsg-0ubuntu0.14.04.1 to 0.99.2+addedllvm-0ubuntu0.14.04.1 clamav-base has been upgraded from 0.98.7+dfsg-0ubuntu0.14.04.1 to 0.99.2+addedllvm-0ubuntu0.14.04.1 clamav-freshclam has been upgraded from 0.98.7+dfsg-0ubuntu0.14.04.1 to 0.99.2+addedllvm-0ubuntu0.14.04.1 libclamav6 has been removed from the system, and replaced with libclamav7 | Low. ClamAV is disabled by default on the Snare Server. If enabled, the "home directory only" and "exclude the data store" options will bypass locations where an unauthenticated user could potentially inject data (via crafted event data). | clamav (0.99.2+addedllvm-0ubuntu0.14.04.1) trusty-security; urgency=medium |
curl has been upgraded from 7.35.0-1ubuntu2.9 to 7.35.0-1ubuntu2.10 | Low. Although the curl binary is installed and available, it is used on a limited basis to collect user and group data from internal data sources, and eventlog information from Lotus Notes/Domino servers. It does not attempt to connect to external sources, unless explicitly misconfigured. | curl (7.35.0-1ubuntu2.10) trusty-security; urgency=medium * SECURITY UPDATE: Incorrect reuse of client certificates with NSS |
dbus has been upgraded from 1.6.18-0ubuntu4.3 to 1.6.18-0ubuntu4.4 dbus-x11 has been upgraded from 1.6.18-0ubuntu4.3 to 1.6.18-0ubuntu4.4 libdbus-1-3:amd64 has been upgraded from 1.6.18-0ubuntu4.3 to 1.6.18-0ubuntu4.4 | Low. Locally logged in users could potentially initiate a limited local denial-of-service against the kernel. Since the Snare Server does not provide general purpose computing resources, the availability of local user accounts is extremely targeted and limited. | dbus (1.6.18-0ubuntu4.4) trusty-security; urgency=medium |
hhvm has been upgraded from 3.15.0~trusty to 3.15.2~trusty | Nil | |
isc-dhcp-client has been upgraded from 4.2.4-7ubuntu12.6 to 4.2.4-7ubuntu12.7 isc-dhcp-common has been upgraded from 4.2.4-7ubuntu12.6 to 4.2.4-7ubuntu12.7 | Nil | isc-dhcp (4.2.4-7ubuntu12.7) trusty; urgency=medium * Don't assume IPv6 prefix length of 64 (LP: #1609898). |
libapache2-mod-php5 has been upgraded from 5.5.9+dfsg-1ubuntu4.19 to 5.5.9+dfsg-1ubuntu4.20 php5 has been upgraded from 5.5.9+dfsg-1ubuntu4.19 to 5.5.9+dfsg-1ubuntu4.20 php5 has been upgraded from 5.5.9+dfsg-1ubuntu4.19 to 5.5.9+dfsg-1ubuntu4.20 php5-cli has been upgraded from 5.5.9+dfsg-1ubuntu4.19 to 5.5.9+dfsg-1ubuntu4.20 php5-common has been upgraded from 5.5.9+dfsg-1ubuntu4.19 to 5.5.9+dfsg-1ubuntu4.20 php5-curl has been upgraded from 5.5.9+dfsg-1ubuntu4.19 to 5.5.9+dfsg-1ubuntu4.20 php5-gd has been upgraded from 5.5.9+dfsg-1ubuntu4.19 to 5.5.9+dfsg-1ubuntu4.20 php5-ldap has been upgraded from 5.5.9+dfsg-1ubuntu4.19 to 5.5.9+dfsg-1ubuntu4.20 php5-readline has been upgraded from 5.5.9+dfsg-1ubuntu4.19 to 5.5.9+dfsg-1ubuntu4.20 php5-sqlite has been upgraded from 5.5.9+dfsg-1ubuntu4.19 to 5.5.9+dfsg-1ubuntu4.20 php5-sybase has been upgraded from 5.5.9+dfsg-1ubuntu4.19 to 5.5.9+dfsg-1ubuntu4.20 | Low. * Although serialized data is processed by the Snare Server, the creation of the serialized information is not under the control of the user; autheticated or otherwise. * Importing image data is not available within the Snare Server, and whilst gd is used in some circumstances to create graphs and related objects, only summarised externally-submitted data is used. * WDXX functions are not in use. * Mysql functions are not in use. * Zip functions are not in use. * ICU library functions are not in use. | php5 (5.5.9+dfsg-1ubuntu4.20) trusty-security; urgency=medium * SECURITY UPDATE: denial of service or code execution via crafted serialized data |
libapt-inst1.5:amd64 has been upgraded from 1.0.1ubuntu2.14 to 1.0.1ubuntu2.15 | Nil | Functionality modifications for extracting information from APT packages |
libapt-pkg4.12:amd64 has been upgraded from 1.0.1ubuntu2.14 to 1.0.1ubuntu2.15 | Nil | Documentation for development of the APT package manipulation program. |
libcurl3:amd64 has been upgraded from 7.35.0-1ubuntu2.9 to 7.35.0-1ubuntu2.10 libcurl3-gnutls:amd64 has been upgraded from 7.35.0-1ubuntu2.9 to 7.35.0-1ubuntu2.10 | Low. Libcurl is used via the php curl extension to query Snare Server agents. If the Snare Server is configured to automatically query/update any client that reports to it, via the Snare Server agent console, a user on the local network that has sent data to the Snare Server and has the ability to configure a http-compatible listener on their local machine could configure an arbitrary response to be sent back to the Snare server. However, the impact at this stage has been assessed as Low, since none of descriptions of the CVEs specified below indicate issues with the small subset of libcurl functions currently used by the Snare Server to collect data. | curl (7.35.0-1ubuntu2.10) trusty-security; urgency=medium * SECURITY UPDATE: Incorrect reuse of client certificates with NSS |
libgd3:amd64 has been upgraded from 2.1.0-3ubuntu0.3 to 2.1.0-3ubuntu0.5 | Minimal. The Snare Server does not use the functions highlighted below, and/or does not allow unrestricted user input when creating images using the GD library. | libgd2 (2.1.0-3ubuntu0.5) trusty-security; urgency=medium |
libgdk-pixbuf2.0-0:amd64 has been upgraded from 2.30.7-0ubuntu1.2 to 2.30.7-0ubuntu1.6 | Minimal. The Snare Server does not manipulate ico files, or use the gdk-pixbuf library for any functionality directly. | gdk-pixbuf (2.30.7-0ubuntu1.6) trusty-security; urgency=medium |
libmysqlclient18:amd64 has been upgraded from 5.5.52-0ubuntu0.14.04.1 to 5.5.53-0ubuntu0.14.04.1 | Nil. The Snare Server does not use mysql libraries. | mysql-5.5 (5.5.53-0ubuntu0.14.04.1) trusty-security; urgency=medium |
libnl-3-200:amd64 has been upgraded from 3.2.21-1ubuntu3 to 3.2.21-1ubuntu4 | Nil | libnl3 (3.2.21-1ubuntu4) trusty; urgency=high |
libpq5 has been upgraded from 9.3.14-0ubuntu0.14.04 to 9.3.15-0ubuntu0.14.04 | Nil. Snare does not use postgresql. | postgresql-9.3 (9.3.15-0ubuntu0.14.04) trusty-proposed; urgency=medium |
libpython3.4-minimal:amd64 has been upgraded from 3.4.3-1ubuntu1~14.04.3 to 3.4.3-1ubuntu1~14.04.4 | Minimal. Snare does not use python directly. | python3.4 (3.4.3-1ubuntu1~14.04.4) trusty-proposed; urgency=medium |
libsmbclient:amd64 has been upgraded from 2:4.3.9+dfsg-0ubuntu0.14.04.3 to 2:4.3.11+dfsg-0ubuntu0.14.04.1 | Minimal. The Snare Server does not use samba in client mode. | samba (2:4.3.11+dfsg-0ubuntu0.14.04.1) trusty-security; urgency=medium |
libssl1.0.0:amd64 has been upgraded from 1.0.1f-1ubuntu2.19 to 1.0.1f-1ubuntu2.21 | Medium. Users who can connect to the Snare Server via SSL, or to an enabled TLS listener on the Snare Server collector, could initiate a level of denial of service, using modified packet data. | openssl (1.0.1f-1ubuntu2.21) trusty-security; urgency=medium |
linux-generic has been upgraded from 3.13.0.95.103 to 3.13.0.101.109 linux-headers-3.13.0-95 has been upgraded from 3.13.0-95.142 to linux-headers-3.13.0-95-generic has been upgraded from 3.13.0-95.142 to linux-headers-generic has been upgraded from 3.13.0.95.103 to 3.13.0.101.109 linux-image-3.13.0-95-generic has been upgraded from 3.13.0-95.142 to linux-image-extra-3.13.0-95-generic has been upgraded from 3.13.0-95.142 to linux-image-generic has been upgraded from 3.13.0.95.103 to 3.13.0.101.109 linux-image-server has been upgraded from 3.13.0.95.103 to 3.13.0.101.109 linux-image-virtual has been upgraded from 3.13.0.95.103 to 3.13.0.101.109 | Additional support for hardware devices. | |
ntpdate has been upgraded from 1:4.2.6.p5+dfsg-3ubuntu2.14.04.8 to 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10 | Low-Medium. ntpdate is used within the Snare Server to potentially synchronise local system time with a remote time source. In normal circumstances, the time source will be an internal, or trusted external entity. The ability to modify the time source configuration is restricted to administrative-level users on the Snare Server. | * SECURITY UPDATE: Deja Vu replay attack on authenticated broadcast mode |
shim-signed has been upgraded from 1.18~14.04.1+0.8-0ubuntu2 to 1.19~14.04.1+0.8-0ubuntu2 | Nil | shim-signed (1.19~14.04.1) trusty; urgency=medium * update-secureboot-policy: |
sudo has been upgraded from 1.8.9p5-1ubuntu1.2 to 1.8.9p5-1ubuntu1.3 | Nil | sudo (1.8.9p5-1ubuntu1.3) trusty-proposed; urgency=medium| |
tzdata has been upgraded from 2016f-0ubuntu0.14.04 to 2016h-0ubuntu0.14.04 | Nil | tzdata (2016h-0ubuntu0.14.04) trusty; urgency=critical * New upstream release, with urgent DST changes for Asia/{Gaza,Hebron}. |
update-manager-core has been upgraded from 1:0.196.21 to 1:0.196.22 | Nil | Update manager and release upgrader. |
vim-runtime has been upgraded from 2:7.4.052-1ubuntu3 to 2:7.4.052-1ubuntu3.1 | Minimal. | vim (2:7.4.052-1ubuntu3.1) trusty-security; urgency=medium |