Sept 2021

The Zeek project announced two security fixes in September.  Corelight’s v22.1 already resolves one of them, and v23 will resolve the denial of service vulnerability.  Concerned customers can receive a patch in advance of v23 through support.

Jan 2021: Sudo (CVE-2021-3156)

The underling OS has a sudo that is vulnerable per this CVE. However users (including admin) can't access the underlying OS because of the appliance design. (In particular the diagnostic shell, which is the closest admins can get, does not have a sudo binary.) And on top of that it's jailed anyway.  All that said, we plan on fixing it; it'll be in the list of CVEs addressed on the support site.

Dec 2020: Sunburst!

It's all over the press, so we wanted to jump in with our "Sunburst" thoughts.  First, we're not an Orion customer.  Second, an internal investigation saw no Orion activity, nor any hits on the IOCs published.  Third, while the details of how the supply chain attack succeeded are sparse, we have high confidence the the security of our product's upgrade chain, so we see no reason for our customers to be concerned about Corelight as a vector.  Finally, Zeek was instrumental in tracking them down!  Read more at: https://corelight.blog/2020/12/15/finding-sunburst-backdoor-with-zeek-logs-and-corelight/

Securty-related changes in our Sensor releases are below, note that many minor CVEs are patched in release without detail here, see the support site for the list:

Oct, 2020

v20 Added more logging to the Audit log and pulled in some Open Source Zeek security fixes (denial of service ones).

Aug, 2020

v19.2 Pulled in Zeek security fixes for potential stack overflow in Netbios-SSN or DNS analysis

July, 2020

v19.1 Fixed privilege escalation bug

June, 2020

v19 Fixed a bug that potentially failed to report errors in applying configurations.
Added more events to audit log
Upgraded to Zeek 3.0.4, including security patches

March, 2020

v18.1 Added an option to disable TLSv1.1

Nov, 2019

v18 Upgraded Bro to 2.6.4 including security fixes
Expanded sensor logging and authentication options, including an audit log, a security banner, cipher suite compliance, and user session timeouts.

Jan, 2019

v1.15 Updated Bro to include version 2.5.5’s security patches.

June, 2018

v1.14.1 Updates Bro to version 2.5.4, which is a security release
v1.14.1 Corelight Announces FIPS 140-2 compliance for the sensors.

Feb, 2018

v1.13 has been released with the Meltdown patch.  Please update to v1.13 or later for the latest in protection.

Jan, 2018

Given widespread concern about the Intel Meltdown vulnerability we wanted to provide an update on steps we're taking to address this issue. While the Corelight Sensor uses Intel processors we believe the risk of data compromise via a Meltdown exploit is very low due to the sensor's design, which limits access to logged in accounts via the Diagnostic Shell. Consequently, we recommend that you verify that SSH access to your Corelight Sensor(s) is appropriately limited. The forthcoming v1.13 sensor software release will also include a patch that fixes this vulnerability.

Nov, 2017

Corelight Sensor v1.12.1:  Open source Bro release 2.5.2 fixed an out-of-bounds write condition which would crash Bro.  This could be used as a denial of service attack against the Corelight Sensor, so we have released v1.12.1 to include Bro 2.5.2 and resolve any potential issue.


    Recent Posts