Database CSV Enumeration Expansion

Introduction

Currently, users have to add each database credential set one at a time and apply each of these credentials to a scan policy. Once the scan is started, each of these credential sets is used to authenticate against each detected database listener possibly resulting in multiple undesirable authentication attempts.

In October 2020, an option was introduced to the Oracle Database Credential for Tenable.sc which allows users to specify a CSV file with the Oracle Database authentication settings used for the scan policy.

Please refer to the original Release Highlight and Oracle Database credentials documentation for more information.

Change

The Database CSV enumeration feature is being expanded to the MySQL, MSSQL, and DB2 Database Credentials along with support in Tenable.io and Nessus.

The CSV format will depend on the database which is specified below.

    DB2: target, port, database_name, username, cred_manager

    MySQL: target, port, database_name, username, cred_manager

    Oracle: target, port, service_type, service_ID, username, auth_type, cred_manager

    SQL Server: target, port, instance_name, username, auth_type, cred_manager

The only credential manager (cred_manager) supported at this time is ‘CyberArk’.

Impact

Since this is a new feature, there should be no impact to users unless they add a CSV to a Database Credential in their scan policy. If the CSV file is correctly configured, users should see less credential attempts to database listeners and more accurate detections of the specified database, potentially resulting in additional vulnerability reports.

Target Release Dates

Tenable.sc : Released in SC 5.17

Nessus      : Released in feed

Tenable.io  : 30 December 2020

----------------------------------------------------------------------------------------------------

Tenable Research Release Highlights are posted in advance of significant new releases or updates to existing plugins or audit files that are important for early customer notification.