Monthly Release Notes - November 2021

Core Security

---

Core Impact

Version: 21.2

November 29, 2021

New Features

• Core Impact can now map and categorize every engagement in MITRE. Impact modules can be filtered by MITRE ATT&CK Framework Tactits, Techniques and Subtechniques. Two new reports that utilize the MITRE ATT&CK Navigator layer output can be generated:

  • MITRE ATT&CK Navigator report

  • NIST 800 Navigator report

• Integration with two new vulnerability scanners have been added:

  • FrontlineVM scanner

  • beSecure scanner

Enhancements

• The Attack Map view is completely interactive and can be used as the primary working space for testers who prefer a fully visualized engagement experience.

• A remote SQLServer engine can be configured to be used as Impact database.

• Dependencies updates:

  • OpenSSL 1.1.1l

  • .NET Framework v4.8

  • psqlODBC 13.02

• Agents’ display name has been enhanced to show the process, pid and user name running it in the remote system.

• Ability to set EHLO/HELO in SMTP Server configuration to explicitly set Impact's host name when sending hello commands (HELO/EHLO) to the SMTP server.

Fixes

• Automatic Impact Updates are being enabled by default.

• Internal workspaces are not shown in the “Workspace Import/Export” wizard.

• A module to run after deploying an agent can be selected in ClientSide exploits.

Back to Top

 

Digital Guardian

---

Agent for macOS

Version: 8.0

November, 2021

New Features

• The 8.0 version of Agent for macOS supports Apple M1 with Big Sur.

• Now you can run DG Agent on all versions of macOS up to macOS Monterey 12.0.1.

• In this release DG Agent Crash Dump Reporting Automation collects information about crashes of DG processes when they occur. The Agent safely uploads the information to a secure cloud repository for analysis by DG personnel. Uploaded crash dump data is purged from the cloud repository after 90 days, but selected data can be moved to Atlassian Jira and remain there longer. The Agent crash dump reporting automation feature employs a widely used open-source component to provide crash dump collection and the SDK of a popular commercial application monitoring and error tracking vendor to upload the data to the secure cloud repository. The only customer task required to support this feature is to enable it in the DGMC. Enabling crash dump reporting automation provides Digital Guardian with consent to collect the crash dump data collected from the Agent computer and the cloud repository. You can enable this feature from the Data tab when configuring the Core Settings configuration resource you plan to use with the Agent. Alternatively, you can enable the <crashReportingEnabled> parameter in a custom configuration resource: <crashReportingEnabled>1</crashReportingEnabled>. Once you enable DG Agent crash dump reporting automation in the DGMC, data about Agent process crashes is collected automatically after the next reboot of the DG Agent computer. Process crash data continues to be collected and analyzed automatically from then on. If this feature is disabled, crash data collection is turned off and no crash dumps are collected.

Agent for Windows

Version: 7.7.1

Nov, 2021

New Features

• Microsoft Windows 11 Certification:

  Digital Guardian has certified Windows 11 with DG Agent 7.7.1 for Windows. DG officially supports using Agent v 7.7.1 or later with Windows 11. DG recommends upgrading to DG Agent 7.7.1 for Windows before upgrading to Windows 11. If you upgrade to Windows 11 first, there is a possibility that either pre-7.7.1 versions of the Agent or Windows 11 will not work properly

Fixes

• Changes to the DG Agent to enable DG to integrate with Microsoft Information Protection (MIP) caused some properties in rules in the Windows DLP Content Pack v 3.0 to operate incorrectly if MIP integration was not enabled and configured. DG made changes to the Agent code so that rules from the v 3.0 Content Pack work properly whether or not MIP integration is enabled.

• Application failures occurred during network traffic inspection due to an edge case buffer overrun. DG modified the DG Agent code to avoid buffer overruns and also removed an obsolete AIM plugin.

• A system failure occurred at a customer installation due to the DG Agent accessing a transient data structure after the data structure was deleted. The Agent code was modified to use a permanent data structure, which prevents the system failure.

• When content was copied from classified files, pasted into a new message in Microsoft Outlook, and sent, during the send mail operation, the file was not detected as classified and a control rule to block sending classified files failed to trigger. This issue was addressed with a code fix.

• Tag propagation failed when text from a file with permanent classification tags was pasted into a file being edited in Notepad++ and also when text was cut and pasted between files being edited using Notepad++ tabs. The DG Agent was altered so that tag propagation now occurs in these scenarios.

• When saving a file using the Save As option in Microsoft Office applications, if you selected SharePoint Sites as the location where you wanted to save your file, and then selected a SharePoint folder, the file was saved in SharePoint, but the DGMC did not show an event. This issue was addressed with a code fix.

• When a large number of files were being copied to an external drive, a NULL pointer error occurred, resulting in a system failure. This issue was addressed with a code fix.

• Some DG Agent sensors that track software and user activities are activated within a process when it starts and deactivated when it exits. To activate and deactivate these sensors, the Agent software must be able to modify executable memory. Some processes might disable Agent sensors at runtime, such as the latest releases of Microsoft Teams. When that happened DG was able to deactivate Agent sensors only partially, causing the Agent computer to fail during the process exit. DG resolved the problem so that now Agent sensors are deactivated properly under all circumstances.

• A highly sensitive timing issue during system shutdown and certain process exits caused an object to be prematurely deleted. DG improved this area of code to minimize the possibility of this occurring.

• Digital Guardian has made enhancements to the device tracking internal database to address unrecoverable errors affecting some Windows Servers.

• When the wipThirdPartyProxyExec custom configuration setting was configured to interoperate with thirdparty proxies, such as Cisco AnyConnect, Sophos, and others, DG was generating network transfer upload (NTU) events against the third-party proxy instead of the Firefox browser. This did not occur with Edge Chromium or Chrome. DG now ensures that NTU events are generated against the Firefox browser.

• When a customer performed an action that resulted in a DGPrompt and then locked their system (for example, using Ctrl+Alt+Del), the DgPrompt was sometimes displayed over the lock screen. This occurred most frequently on Windows 10 Pro systems. The DGAgent code now detects the locked state and adjusts the display of the DgPrompt accordingly. When the system is unlocked, the DGPrompt is brought to the forefront.

Back to Top

 

Globalscape

---

EFT Enterprise

Version 8.0.6.18

November 07, 2021

Fixes

• Fixed an issue where Windows permissions were not used for NT/AD site user created by login via HTTP (TFS 381871, Case 94506)

• Fixed and issue where users were unable to send a workspace share to existing users within a blacklisted domain (TFS 382023)

EFT Express

Version 8.0.6.18

November 07, 2021

Fixes

• Fixed an issue where Windows permissions were not used for NT/AD site user created by login via HTTP (TFS 381871, Case 94506)

• Fixed and issue where users were unable to send a workspace share to existing users within a blacklisted domain (TFS 382023)

Back to Top

 

Sequel

---

Sequel Data Warehouse Client

Version: 08.2.2814

November 10, 2021

Fixes

• Double Click on a structured rule in an extract could cause the client to lock up

• Validation error in SQL Select expression for Transaction Data Source when referencing numeric parameters multiple times in the expression

Sequel Data Warehouse Server

Version: 08.2.10

November 10, 2021

Fixes

• Group Import error for Views or MQTs when requested from the ‘Type’ panel.

• Group Import error when working with Data Sources if Text data sources exist.

• Error introducing a DDM file as a data source if it was based on a remote logical file.

• Creation of the first UDF in an environment failed.

• Creation of the error recovery file for an extract could fail if the Transaction table had an SQL name longer than 30 characters.

• View/MQT Comparison report between two environments could show incorrect differences due to different generated short name.

• Execution error in extract could occur if multiple run-time parameters were referred to more than once in the SQL select expression.

Back to Top

 

TeamQuest

---

Automated Analytics

Version 11.3.28

November 16, 2021

Enhancements

• Updated Apache Tomcat to version 8.5.70.

Fixes

• Added an option to create VMware cluster groups with virtual machines to the "Generate Groups VMware" view.

TeamQuest Administration Console

Version 11.4.3

November 16, 2021

Enhancements

• Updated Apache HTTPD to version 2.4.51 to resolve security vulnerabilities.

TeamQuest Manager

Version 11.4.9

November 16, 2021

New Features

• Added NFS file space metrics.

• Added support for Microsoft Windows Server 2022.

• Added support for AIX 7.3.

Enhancements

• Updated Apache HTTPD to version 2.4.51 to resolve security vulnerabilities.

• Added a configuration setting for turning NFS file space metrics collection on/off.

VCM

Version 2.12.0

November 16, 2021

New Features

• Added support for Microsoft Windows Server 2022 for Vityl Collector.

Enhancements

• Updated Apache Tomcat to version 8.5.70.

Fixes

• Added an option to create VMware cluster groups with virtual machines to the "Generate Groups VMware" view.

• Resolved an issue with PostgreSQL not starting after a system reboot due to an error accessing the lock file.

• Updated usernames to allow underscore characters.

Vityl Monitor

Version 11.4.4

November 16, 2021

Enhancements

• Updated Apache Tomcat to version 8.5.70.

Fixes

• Hid Tomcat Server information on a 404 error for Vityl Monitor.

Back to Top