Loading...
Security Resources

Software Updates

Database Security

Database Security Knowledgebase Update 6.34

access_timeAugust 02, 2023
share

Trustwave Database Security Knowledgebase (ShatterKB) 6.34 is now available. It introduces new checks for Oracle, Microsoft Azure SQL Database and MySQL.

New Checks - Microsoft Azure SQL Database

  • Azure SQL Database code review
    • Description: Verify Azure SQL Database code (stored procedures, functions, triggers), application code, settings, column and field definitions, and constraints to determine whether the database is protected against invalid input.
    • Risk: Medium

 

  • Database object ownership
    • Description: List of database object owners.
    • Risk: Medium

 

  • Security Labeling of Information in Storage
    • Description: Ensure that security labeling requirements have been specified, and a third-party solution, SQL Information Protection, or an Azure SQL Database Row-Level security solution is implemented that reliably maintains labels on information in storage.
    • Risk: Medium

 

  • Ensure Audit logging is enabled
    • Description: Check if an audit is enabled.
    • Risk: Medium

 

  • Ensure audit records are generated for defined auditable events
    • Description: Check if server level audit is enabled.
    • Risk: Medium

 

  • Ensure Audit generate records when unsuccessful attempts to retrieve privileges occur.
    • Description: Check if audit records are generated for unsuccessful attempts to retrieve privileges.
    • Risk: Medium

 

  • Azure SQL Server only authorized users allowed to modify database structure and logic modules
    • Description: List principals that are allowed to modify modules and database structure.
    • Risk: Medium

 

  • Database principals with permissions to install logical modules
    • Description: Verify which users and roles have permissions to create, alter, or replace logic modules.
    • Risk: Medium

 

  • Ensure Audit records are generated when privileges are retrieved
    • Description: Check if audit records are generated when privileges are retrieved.
    • Risk: Medium

New Checks - MySQL

  • Critical Patch Update - July 2023
    • Description: Check version to determine if the database contains vulnerabilities described by Critical Patch Update - July 2023.
    • Risk: High

 

  • Critical Patch Update - July 2023
    • Description: Check version to determine if the database contains vulnerabilities described by Critical Patch Update - July 2023.
    • Risk: High

New Checks - Oracle

  • Oracle Critical Patch Update/Patch Set Update - July 2023
    • Description: Check version to determine if the database contains vulnerabilities described by Critical Patch Update/Patch Set Update - July 2023.

IMPORTANT! This check is designed to verify if a specific CPU/PSU is needed and installed. If you do not have adequate privileges on the database or operating system, the check may indicate it can not detect if the CPU/PSU is installed. In this case, ensure you have adequate permissions and re-run the check.

                Risk: High

  • DBMS low risk administrative privilege assignment
    • Description: Verify that low risk administrative privileges are assigned through roles and not directly assigned to user accounts.
    • Risk: Medium

 

  • Oracle Critical Patch Update/Patch Set Update - July 2023
    • Description: Check version to determine if the database contains vulnerabilities described by Critical Patch Update/Patch Set Update - July 2023.

IMPORTANT! This check is designed to verify if a specific CPU/PSU is needed and installed. If you do not have adequate privileges on the database or operating system, the check may indicate it can not detect if the CPU/PSU is installed. In this case, ensure you have adequate permissions and re-run the check.

                Risk: High

Availability

  • Available to all AppDetectivePRO and DbProtect customers with maintenance (subscription or perpetual) in good standing at no additional cost.
  • Download SHATTER Knowledgebase from the Trustwave Support Portal. (https://www.trustwave.com/company/support/ and select AppDetectivePRO or DbProtect)
  • AppDetectivePRO customers can use the Updater within the product as well