Skip to content

Finding PaperCut MF and NG servers

PaperCut recently revealed that two products in its popular line of print server software contain severe vulnerabilities currently being exploited in the wild. Reported via the Trend Micro Zero Day Initiative, these vulnerabilities can be exploited by unauthenticated attackers to achieve remote code execution as the SYSTEM user (CVE-2023-27350/ZDI-CAN-18987) or information disclosure, including user information and password hashes (CVE-2023-27351/ZDI-CAN-19226).

What is the impact?

With a CVSS score of 9.8 (“critical”), CVE-2023-27350/ZDI-CAN-18987 exists in the SetupCompleted class and can be leveraged for unauthenticated remote code execution due to improper access control. The Application Server and Site Server components of PaperCut MF and NG product versions 8.0 and later contain this flaw.

CVE-2023-27351/ZDI-CAN-19226 has been assigned a CVSS score of 8.2 (“high”) and exists in the SecurityRequestFilter class as a flaw in the authentication algorithm, allowing for unauthenticated information disclosure. The Application Server component of PaperCut MF and NG product versions 15.0 and later contain this flaw.

PaperCut’s website claims over 130 million users of their products across almost 90,000 organizations in almost 200 countries, including government, commercial, and educational users. Coupled with the substantial list of affected product versions and exploitation of these vulnerabilities already observed happening in the wild, the impact could be quite broad. Trend Micro will defer disclosing more details on these vulnerabilities until next month in order to give PaperCut customers time to patch.

While a definitive indicator of compromise doesn’t exist in detecting exploitation of these vulnerabilities on a target, PaperCut does offer some clues one can look for.

Are updates available?

Last month, PaperCut released patched versions 20.1.7, 21.2.11, and 22.0.9 which fix these vulnerabilities. Older unsupported/end-of-life versions will not be receiving a patched update.

For admins who cannot patch immediately, PaperCut does provide a mitigation for CVE-2023-27351/ZDI-CAN-19226, but none is available currently for CVE-2023-27350/ZDI-CAN-18987.

How do I find potentially vulnerable PaperCut services with runZero?

From the Services inventory, use the following prebuilt query to locate all PaperCut MF and NG servers in your network:

_asset.protocol:http and protocol:http and (http.body:"PaperCut MF is a print management system" OR last.http.body:"PaperCut MF is a print management system" OR http.body:"PaperCut NG is a print management system" OR last.http.body:"PaperCut NG is a print management system")

As always, any prebuilt queries are available from your runZero console. Check out the documentation for other useful inventory queries.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.

Asset inventory is foundational to security programs

Think of the technological ecosystem an organization relies on to operate efficiently and effectively: desktop workstations, mobile devices, IT/IoT/OT devices, virtual systems, web apps, data, cloud infrastructure–just to name a few. Keeping track of every single one of these devices feels impossible.

As the number and types of assets continue to grow exponentially, organizations need help staying on top of these devices. Left unmanaged, these devices can act as potential footholds for malicious actors. Security teams need to be able to discover and identify unmanaged assets if they ever want to secure or protect them. How could they effectively secure and protect their organization if there are assets they don’t know about–what they do, where they are, or what their status is?

 

Cybersecurity frameworks and regulations start with a comprehensive asset inventory

Asset inventory is the foundation of a strong cybersecurity posture. It is often considered the first step in identifying potential risks to your organization’s security. This is why it is a key recommendation in many cybersecurity frameworks, including the NIST Cybersecurity Framework (CSF) and CIS Controls. By maintaining an up-to-date inventory of all hardware, software, users, and digital assets across your organization, you can better understand your attack surface and take proactive measures to protect against potential threats.

Let’s take a look at some of the major frameworks and regulations that require an asset inventory.

CIS Controls

The Center for Internet Security (CIS) provides a list of recognized standards for defending your systems and data against modern cyber threats. Cybersecurity professionals and subject matter experts use a consensus-based process to establish these controls. Organizations such as ISC2 and the SANS Institute contribute to the process.

You can consider the CIS Controls an essential safety check that ensures you have your house in order by following security best practices. It speaks volumes that the first control on the list, seen as foundational for good cyber hygiene, is “Inventory and Control of Enterprise Assets.” The rationale is that you need an up-to-date inventory to know what to monitor and protect within the enterprise. An asset inventory also helps you identify unauthorized and unmanaged assets to remove or remediate.

NIST CSF

The NIST Cybersecurity Framework (NIST CSF) is a set of cybersecurity guidelines developed by a non-regulatory agency of the United States government. The NIST CSF is about guidance and best practices with a framework centered around five core functions: Identify, Protect, Detect, Respond, and Recover.

It’s in the Identify function of this framework that asset inventories get flagged as vital for modern cybersecurity programs. According to the framework, the Identify function is all about “risk to systems, people, assets, data, and capabilities.” A big part of this is knowing what assets you actually have.

SOC2

SOC2 is a voluntary compliance standard, but it’s often required to land vendor contracts, particularly with SaaS and B2B companies. Compliance with SOC2 shows clients and partners that your company maintains the highest standards of information security. Meeting SOC2 requirements can make all the difference in whether you succeed in various industries and types of services.

Effective IT asset management is pivotal for obtaining SOC2 certification. In particular, the certification looks for your ability to safeguard assets against unauthorized access and reliably assign owners and users to assets.

HIPAA

Compliance with the Health Insurance Portability and Accountability Act (HIPAA) is essential in the healthcare industry. High standards of security must protect sensitive patient healthcare information. Violations of HIPAA are costly from a financial standpoint, and the penalty involved depends on the level of negligence.

Healthcare providers and business associates need IT asset inventories in order to track the location of electronic health information (ePHI). This reliable, up-to-date asset inventory helps comply with the regulation’s Security Rule.

PCI DSS

The Payment Card Industry Data Security Standard (PCI DSS) is a mandatory regulation aimed at protecting cardholder data. Companies that store, process, or transmit cardholder data must comply with PCI DSS. In requirement 2.4 of PCI DSS, the regulation requires companies to maintain an inventory of physical devices, software, user accounts, and more.

The elusive single-source-of-truth for assets

An asset inventory is like the blueprint of a house–without it, there isn’t a clear understanding of what needs protecting. But just like how blueprints can change over time with additions and renovations, an inventory can also become outdated as assets get added or removed from the network.

Networks change constantly, with users logging into enterprise platforms from personal devices or rapidly spinning up new cloud infrastructure that often gets forgotten about. Unsanctioned shadow applications get stood up or accessed by different departments. Add remote work and the continued proliferation of IoT devices to the mix, and you have a more complex IT ecosystem that’s harder to track than ever.

A couple of statistics that drive home the challenges include:

  • Shadow IT cloud usage is estimated to be 10x the size of known cloud usage.
  • One survey found just 28 percent of companies thought their asset inventories were more than 75 percent complete.

Why do asset inventories pose such a challenge for so many organizations? Part of the challenge is that many companies use outdated processes, like spreadsheets, for tracking and managing their cyber assets. As a result, gaps in visibility emerge regularly in today’s dynamic IT ecosystems and risky security scenarios are commonplace. For these reasons, it’s crucial to have a system in place that allows for continuous discovery and monitoring of assets.

The risks of not having an accurate asset inventory

If you’re not proactively maintaining and analyzing your asset inventory, you’re putting your organization at risk. An up-to-date and comprehensive asset inventory is essential for you to make informed business decisions and ensure operational efficiency. Let’s take a look at some of the common issues you’ll encounter when your asset inventory is lacking.

Issue 1: Misalignment between IT and security teams

IT and security teams end up counting different numbers of assets, depending on how they track and update their inventories. This makes it hard to discern the truth of what your IT ecosystem looks like and reduce risks.

Issue 2: Weak security controls coverage

Given the lack of a single source of truth, gaps are more likely to arise in security control coverage. Different teams take responsibility for various areas of security. If these teams lack alignment you’ll end up with a lack of visibility into security controls coverage, leaving you unaware of:

  • Endpoints not covered by an endpoint detection and response solution (EDR), such as CrowdStrike.
  • Missing hosts from the SIEM tools used by security operations teams to correlate events and proactively respond to more advanced threats.

Issue 3: Failure to manage risky assets

An asset inventory is crucial for identifying and responding to security risks. Not all assets pose the same level of risk, and a comprehensive inventory helps to identify those that do. For example, an isolated device with encrypted traffic may be less risky than an internet-facing asset with insecure configurations. By keeping track of all assets, organizations can respond quickly to zero-day vulnerabilities that require immediate attention. For example, the Log4 vulnerability affected up to 3 billion devices, highlighting the importance of maintaining an up-to-date inventory for efficient vulnerability response.

Issue 4: Lack of asset ownership

Asset ownership is a critical component of asset inventory, as it defines who is responsible for managing and securing each asset. The Equifax breach serves as a prime example of the consequences of not having proper asset ownership in place–without clear ownership over a legacy internet-facing system, no one took responsibility for ensuring that it was scanned and patched regularly. To avoid similar incidents, organizations must prioritize establishing clear lines of asset ownership and incorporating them into their overall security program.

Build the foundation for your security program

Given the modern threat landscape and the fluid nature of IT environments, organizations must regard an accurate and up-to-date asset inventory as a basic tenet of an effective security program. Given the challenges and risks involved, it’s time to move on from manual processes that provide point-in-time static snapshots that often don’t resemble the true state of your network.

Take the first step towards improving your security posture by moving to cyber asset management solutions that can keep pace with the assets connected to your network. A truly effective cyber asset management solution offers advanced fingerprinting techniques and leverages asset data from multiple sources to provide a comprehensive view of your asset inventory–from IT to OT devices, on-premise to cloud to remote environments.

How runZero can help

runZero can help you to gain visibility into all the assets connected to your network, so you can proactively defend against cyber threats. First, you can identify all the assets connected to your network, including those that may have been forgotten or overlooked. Second, you can track changes made to these assets over time. Third, you can assess the risk associated with each asset and prioritize remediation efforts accordingly. As a result, you can improve your organization’s overall security posture by having a complete understanding of your asset inventory.

Ready to take the next step? runZero is the fastest and easiest way to get to full asset inventory across IT, OT, on-premise, cloud, and remote environments.

Build your asset inventory in minutes

runZero is a cyber asset management solution that delivers full cyber asset inventory–quickly, easily, and safely. The solution enriches existing IT & security infrastructure data–from vuln scanners, EDRs, and cloud service providers–with detailed asset and network data from a purpose-built unauthenticated active scanner. No credentials required. Just deploy an Explorer and start scanning.

Get runZero for free

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.

Introducing runZero’s new ServiceNow Service Graph integration: Get greater data accuracy for your CMDB

Big news: runZero now integrates with ServiceNow Service Graph. The runZero Service Graph integration offers a robust solution for organizations who need to get a comprehensive and up-to-date view of asset data across IT (information technology), OT (operational technology), cloud, and remote environments. This new integration will quickly and easily enrich CMDBs with high-fidelity, contextualized asset details, superseding the existing ETL integration.

The importance of data quality in CMDBs

According to Gartner, nearly one third of CMDB challenges stem from data completeness or quality concerns, which highlights the importance of prioritizing data quality in an organization’s configuration management database (CMDB). This is not just a theoretical concern: Gartner also notes that 99% of organizations using CMDB tooling who do not address configuration item data quality gaps will experience visible business disruption. This makes sense when you consider that IT infrastructure and services are critical components of most modern businesses. Without accurate information about these assets, it becomes difficult to make informed decisions related to security, compliance, risk management, and more.

To deliver better and complete visibility across your environment, the Service Graph Connector brings your runZero asset inventory into your ServiceNow CMDB. With better data quality in your CMDB, you can ensure they get managed in accordance with your organization’s policies. By leveraging runZero’s ServiceNow Service Graph integration, you can improve your CMDB accuracy and reduce the likelihood of costly disruptions caused by inaccurate data. You can be confident that you’re operating on every asset–even the ones your CMDB didn’t know about.

Eliminate data quality gaps and improve IT/IoT/OT asset visibility with runZero’s ServiceNow Service Graph integration

Many organizations are turning to Cyber Asset Management (CAM) solutions to gain better visibility into IT, IoT, and OT assets. These solutions can help proactively identify unmanaged devices and uncover security risks within networks. By using both API data sources and unauthenticated active scanning, runZero is one of the few solutions capable of discovering unmanaged IT, IoT, and OT devices. This approach is especially valuable in OT environments, where visibility may be limited.

runZero’s ServiceNow integration provides you with a powerful tool to improve your asset inventory and cyber asset management. With this integration, you can gain better visibility into IT, IoT, and OT assets, as well as identify and address data quality gaps. This can help you reduce the cost of downtime, improve labor productivity, and get more value from your CMDB investments. In addition, runZero’s active scanner is safe to use in OT environments, ensuring that you can get the most out of your cyber asset management solutions without compromising the safety of your systems. Dozens of organizations are using runZero’s combination of integrations and active discovery, including those in manufacturing, healthcare and utilities, to achieve full asset inventory.

How Capgemini helped their client get better quality data for their CMDB

Let’s take a look at the real world implications of not having a dedicated cyber asset management solution in place.

Capgemini, a global IT consulting firm, was contracted by a French manufacturer and retailer of luxury products to deploy an asset discovery solution and set up the integration with the new CMDB to store the company’s IT asset inventory. However, they were struggling to get the data they needed using MID Servers–especially for managed assets such as routers and switches. They knew they had to explore other asset discovery options.

One of the primary requirements established for the project was unauthenticated asset discovery. The IT department, part of the holding company, was having a hard time collecting credentials for service accounts for many parts of the business. Without credentials, ServiceNow was struggling to inventory most assets. As Capgemini looked into other solutions, they discovered runZero, which delivered everything their client needed: speed, accuracy, a rich API, and unauthenticated scans. runZero’s asset discovery was fast, efficient, and worked without credentials. With runZero, they found 2.5x as many devices as ServiceNow.

After seeing the results with runZero, Capgemini has other ideas for capitalizing on its capabilities. As they work with clients in future projects, runZero will give them an accurate picture of their client’s asset inventory enabling them to provide precise project plans with known scope, schedule, and cost estimates.

Ready to get better results from your CMDB investments? To get started, sign up for runZero and then get the ServiceNow Service Graph integration on the SNOW marketplace.

Be confident in your CMDB’s data quality

runZero is a cyber asset management solution that delivers full asset inventory–quickly, easily, and safely. The solution enriches CMDBs with detailed asset and network data from a purpose-built unauthenticated active scanner. Discover every asset–even the ones your CMDB didn’t know about. 

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.

runZero partners with Abira Security

runZero partners with Abira Security, a full service cybersecurity advisor 
and managed services provider.

runZero is excited to announce our partnership with Abira Security, a market-leading provider of comprehensive cybersecurity solutions. As part of this partnership, Abira will be offering runZero as a solution to solve the challenges of cyber asset management. runZero’s asset inventory and discovery capabilities are the key to delivering a complete security package.

At runZero, we believe network visibility and asset inventory is a foundational part of maintaining a strong security posture. Abira offers a complete portfolio of cybersecurity solutions, paired with exceptional strategy expertise and real-world experience. Partnering with Abira Security allows runZero to expand and reach more organizations that are searching for a complete security strategy that includes deep network visibility and comprehensive asset inventory.

Eric Goldstein, Director of Channel at runZero, says, “We’re thrilled to be partnering with Abira Security to deliver cyber asset management to our joint customers. A comprehensive asset inventory is essential for any security program and is often the very first step in a security assessment. Together with runZero, Abira will help customers achieve their security goals and maximize their security tech stack value.”

“Abira is a pure play cybersecurity services firm and a true VAR. Our quality, flexibility, and cost structure is hard to beat,” says Ray Harrison, Sales Director at Abira Security.

Organizations today face ever-increasing cyber threats that can compromise their sensitive data and operations. The first step in securing any network is developing a complete asset inventory that accounts for all devices: managed or unmanaged; IT, OT, or IoT; cloud, on-prem, or remote. Combining runZero’s asset inventory capabilities and Abira’s cybersecurity expertise, customers have the benefit of an end-to-end solution that helps them identify, secure, and manage all of their assets, no matter where they exist, safely and effectively.

For more information, visit https://abirasecurity.com/.

Strengthen your security posture with cyber asset management

runZero is a cyber asset management solution that delivers full cyber asset inventory–quickly, easily, and safely. The solution enriches existing IT & security infrastructure data–from vuln scanners, EDRs, and cloud service providers–with detailed asset and network data from a purpose-built unauthenticated active scanner. No credentials required. Just deploy an Explorer and start scanning.

Get runZero for free 

Partnership Will Drive Increased Adoption of Portnox’s Cutting-Edge NAC Solution Purpose-Built for Large Distributed Organizations in the Region

LONDON — Portnox, which supplies network access control (NAC), visibility and device risk management to organizations of all sizes, today announced that it has partnered with Distology for the sole distribution and resell of its cloud-delivered NAC-as-a-Service solution in the United Kingdom and Ireland.

We chose to partner with Distology because of their successful history of IT security solution distribution in the UK and Irish markets, said Portnox CEO, Ofer Amitai. Were confident this collaboration will yield tremendous growth for both parties, as Portnox has a unique value proposition and Distology has the market enablement expertise to effectively evangelize our network security offering.

We have a long-established relationship with Portnox and it speaks volumes that the team have decided to choose Distology as their sole UK&I distributor. The technology Portnox brings to the market is incredibly exciting and complements our existing vendor stack effortlessly, said Stephen Rowlands, Head of Sales for Distology. Were especially looking forward to representing and promoting Portnox Clear to our growing partner base, as this brand-new cloud-based technology has potential to completely disrupt the market and we foresee masses of growth potential in this innovative product.

Portnox introduced its cloud-delivered NAC-as-a-Service solution to the UK & Irish markets less than two years go. As the first to bring NAC to the cloud, Portnox has quickly gained a foothold in the region, particularly among large distributed enterprises in the retail, construction and utilities industries.

The adoption of our NAC-as-a-Service product in the UK has been very strong to date, said VP of Products, Tomer Shemer. This is a testament to the fact that the UK is one of the markets leading the trend of cloud security adoption. We expect to see continued growth in the coming years in this area of Europe.

Portnox is set to exhibit at this week’s RSA 2020 Conference (booth #4234) in San Francisco, February 24-28. Additionally, Portnox (booth #G108) and Distology (booth #C40) will both be exhibiting at InfoSec Europe 2020, Europes largest event for information and cyber security, in London, June 2-4.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

About Distology
Distology is a Market Enabler and offers true value for the distribution of disruptive IT Security solutions. The vendors we work with represent innovative and exciting technology that continues to excite and inspire their reseller network. Our ethos is based on trust, relationships, energy and drive and offers end to end support in the full sales cycle providing vendor quality technical and commercial resource.

runZero 3.7: Custom integrations and SDK

What’s new with runZero 3.7?

  • Custom integrations and Python SDK
  • ServiceNow Service Graph Connector for runZero
  • Protocol improvements
  • New and improved fingerprints

Custom integrations and Python SDK

runZero Enterprise customers can now import assets from custom sources using the runZero SDK. The new Python SDK supports runZero’s custom integration API functions for ease of automation and use for those familiar with Python. These custom integrations allow for creating and importing asset types not previously supported within runZero, along with assigning the integration a name, description, and custom icon. Once imported, you can manage these custom integration sources from the runZero UI, and remove them from assets if desired. This will allow you to build new integrations and further enrich the asset data within runZero.

ServiceNow Service Graph Connector for runZero

The runZero Service Graph connector is now available in the ServiceNow marketplace. The connector can automatically pull your runZero asset data into your CMDB, merging with your ServiceNow data to improve asset visibility and accuracy. This connector does not replace the ServiceNow IntegrationHub ETL integration; both the connector and integration are available to Enterprise customers. ServiceNow Service Graph connector for runZero

Protocol improvements

The 3.7 release includes improved support for the Checkmk host agent. Checkmk is an open source host monitoring service and is deployed as part of many solutions and network appliances. Customers with Checkmk in their environment will benefit from improved software inventory and EDR detection for these assets. The accuracy of operating system fingerprinting has also been improved using available Checkmk data. The scanner now supports the Steam In-Home Streaming Discovery Protocol, allowing for identification of devices running the Steam client from Valve Software.

New and improved fingerprints

A number of fingerprints and fingerprint capabilities have been improved in this release. These improvements include fingerprinting of TLS stacks, better coverage of Roku devices based on AirPlay responses, and improved OS fingerprinting of devices speaking the BACnet protocol. New fingerprints were added for products by Abbott, Aruba, Audioscan, Bayer, Canon, Ciena, Cisco, Crestron, FloLogic, GE HealthCare, GE MDS, Google, H3C, Huawei, IBM, Keyence, Meross, Logitech, NetApp, Panduit, Proofpoint, Roku, Quantum, Raritan, Roku, Shelly, SonicWall, Tesla, TP-Link, and VMware.

See runZero 3.7 in action

Watch the video to see a preview of some of the newest features in runZero, including the ServiceNow connector, Checkmk protocol parser, and custom integrations leveraging the Python SDK.

Release notes

The runZero 3.7 release includes a rollup of all the 3.6.x updates, which includes all of the following features, improvements, and updates.

New features

  • Customers with an enterprise license can now create custom integrations and import assets from any external asset data source using the runZero Python SDK.
  • Improved performance and reliability of metrics calculations.
  • Improved performance of the vulnerabilities inventory.
  • AWS permission errors are now more detailed to make troubleshooting easier.
  • A bug where the asset ownership tag was not able to be changed successfully has been resolved.
  • A bug where email addresses were case sensitive on sign in has been resolved.
  • A bug where the “Create Organization” button appeared disabled but was still clickable has been resolved.
  • A bug preventing the Asset Ownership goals toggle from being clickable has been resolved.
  • Upgraded npcap to version 1.73
  • Fingerprint updates.

Security fixes

  • A bug that could show cross-tenant Queries and their associated author email addresses was resolved. This issue only applied to a cloud-hosted version of the runZero platform that was live for slightly more than two hours on March 29th, 2023. Any customers affected by this issue received a detailed notice. This affected version 3.6.14.
  • A bug that could allow an organization admin to see the names of other organizations in the tenant, even without explicit access, has been resolved. This affected versions 3.6.0 to 3.6.5.
  • A bug that could expose limited information about an organization to cross-tenant users has been resolved. This issue could have allowed an attacker that guessed the v4 UUID of an organization to view the name, description, and top-level statistics (asset count, service count, task count, etc.) without appropriate authorization. This affected versions 3.6.0 to 3.6.4.

Product improvements

  • Improved quality of errors reported by the CLI Scanner.
  • Improved user experience of user management.
  • Improved user experience of organization management.
  • Packets sent/received are now visible from the tasks preview.
  • Enterprise customers can now scan all ports and up to a /8 at a time using the hosted scan engines.
  • Attribute searches and reports are now faster in large organizations.
  • It is now possible to download the task log for a failed scan.
  • Hosted scans no longer ignore responses from common firewalls.
  • Daily asset expiration now records an assets-expired event with the count.
  • The task-failed event now includes information about the associated Explorer.
  • Scans can now configure specific probes for Subnet and Host pings.
  • Asset queries can now surface overlaps in asset names, IP addresses, and MAC addresses across inventory.
  • Behavior around parent/child organizations has been improved.
  • A change to Chrome which caused web screenshots to fail has been addressed.
  • Alert rules now support software and vulnerability queries.
  • Asset ownership now supports references to runZero users and groups.
  • Vulnerability inventory now includes an Exploit status, indicating whether the vulnerability is known exploitable. The Exploit status will only be populated for vulnerabilities imported after this release.
  • Datagrids across the UI no longer use the incorrect theme.
  • Task WLAN listing functionality has been improved to enforce a timeout if the underlying utility is slow or unresponsive.
  • The maximum time to complete an SNMP walk is now configurable.
  • The default maximum time to complete an SNMP walk has been increased to 5 minutes from 1 minute.
  • The maximum results for an SNMP walk have been increased to 8k from 4k.
  • Assets owned by a runZero user will now be displayed on the user details page.
  • The Reason column in the failed tasks table will now properly persist the hidden state between page loads.
  • Saved queries can now be created for software, vulnerabilities, and screenshots.
  • Attribute reports now group unique values within a single key.
  • The View More link is now accessible for in-progress tasks.
  • Asset owner names now suggest auto-complete options.
  • Accessibility improvements.
  • Client-side timezone updates.
  • Improved performance of the organization details page.

Integration improvements

  • The AWS integration now supports the GovCloud partition for assumed roles.
  • Validation warnings for internal IPs when using LDAP and InsightVM integrations has been improved.
  • Filtering of non-unique MAC addresses has been improved to better support Cisco virtual MAC addresses.
  • Cisco virtual MAC addresses are now handled more consistently.
  • Increased timeouts for the Tenable integration.
  • Improved reliability of CrowdStrike credentials verification.
  • The API response for a PUT request to /org/sites now returns the details of the new site.
  • Improved reliability of the Tenable integration.
  • API requests to apply tags to one or more assets now complete much faster.

Bug fixes

  • A race condition that could occur during self-hosted installation has been resolved.
  • A bug that could cause the Tenable connector to fail intermittently for some customers has been resolved.
  • A bug that could cause task details not to render on the task overview screen has been resolved.
  • A bug that could prevent organization administrators from creating new projects has been resolved.
  • A bug that could prevent some CrowdStrike software from importing successfully has been resolved.
  • A bug that caused misaligned values when exporting assets to CSV has been resolved.
  • A bug that could cause the SSO page to render off screen has been resolved.
  • A bug that could prevent asset modifications triggered by alert rules has been resolved.
  • A bug that could prevent the dashboard from loading successfully has been resolved.
  • A bug that caused misaligned values when exporting assets to CSV has been resolved.
  • A bug that could cause assets to incorrectly merge has been resolved.
  • A bug that could prevent validation of hostname scan targets has been resolved.
  • A bug that could lead to inaccurate asset correlation has been resolved.
  • A bug which could result in runZero attributes being removed from Offline assets has been resolved.
  • A bug that could prevent subnet stats from being exported has been resolved.
  • A bug that could prevent analysis queries from running for directory users and groups has been resolved
  • A bug that prevented match counts from being displayed on the queries page has been resolved
  • A bug that could prevent updating assets with a large number of vulnerabilities has been resolved
  • A bug that prevented access to runZero canned Queries has been resolved.
  • A bug that could lead to the self-hosted installer not removing temporary files has been resolved.
  • A bug that led to slow SNMP scans of specific Cisco switches has been resolved.
  • Addresses bug where recurring tasks that are “Removed” were still showed in the tasks page after the associated site is deleted
  • A bug preventing asset owners from being updated has been resolved.
  • A bug that could result in inaccurate vulnerability counts for assets has been resolved.
  • A bug that could prevent a subset of vulnerabilities from being saved for multi-source assets has been resolved.
  • A bug that caused errors for Crowdstrike integrations with large amounts of applications has been resolved.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.

×

Hello!

Click one of our contacts below to chat on WhatsApp

Social Chat is free, download and try it now here!

×