Code Reuse

Rule 801378
Status	Active
Alert Message	Software vulnerable to code reuse attacks

Summary

The vulnerability scanner has identified that the software in your environment is not adequately hardened and could be easily exploited by a remote attacker.

Description

The weakness that the Atomicorp platform has detected confirms that your system is vulnerable to a dangerous category of code reuse attacks. These attacks would allow an attacker to use the code in the software for an unintended purpose and thus take over the system. From there, they could remotely execute the code of their choice and cause significant damage. Example attacks could be privilege escalation, traversing to other areas of your environment, direct damage to the system causing downtime or data exfiltration...among others.

Even though the software developer for this system may have good security practices in place, using rigorous code scanning, pen testing and the like, vulnerabilities still exist. Upgrading to the latest security patch does not ensure that your systems are hardened to the fullest extent necessary.

Solution

Atomicorp has partnered with RunSafe Security to harden your system from these types of attacks. RunSafe has built a software transformation engine called Alkemist which immunizes code from these types of vulnerabilities. Alkemist can apply protections directly to your system’s code and thereby render code reuse attacks inert. Our scans indicate that this vulnerable system is an ideal candidate for Alkemist protections and can be easily deployed in place of the current system.

For additional information on RunSafe Alkemist, please visit www.runsafesecurity.com

Supported Platforms :

• Redhat 7

• Centos 7

To Enable

Step 1) Add Runsafe to your subscription here https://www.atomicorp.com/amember/cart

Step 2) Select the API key from the email sent to your registered email address

Step 3) In the AWP Console, select Hub Configuration->Runsafe Security Settings

Step 4) Enable the runsafe module, add your API key, and Click Save

Step 5) Log in to the system, and run the following:

sudo /var/awp/bin/runsafe-connector.sh -s premium

Step 6) List available Alkemist updates:

sudo /var/awp/bin/runsafe-connector.sh -l

Step 7) Update the system using yum:

yum update <packagename>

Troubleshooting

False Positives

None.

Tuning Guidance

None.

Additional Information

Similar Rules

None.

Knowledge Base Articles

None.

Outside References

None.

Notes

None.