Method and system for identifying, fixing, and updating security vulnerabilities

• US 6,907,531 B1
• Filed: 06/30/2000
• Issued: 06/14/2005
• Est. Priority Date: 06/30/2000
• Status: Active Grant

• Current Assignee: Finjan Blue, Inc. (SoftBank Group Corp.)
• Original Assignee: Internet Security Systems Incorporated (International Business Machines Corporation)
• Inventors: Sells, Martin D., Overcash, Kevin A., Dodd, Timothy D., Williams, Bobby J., Dennerline, David A., Ide, Curtis E., Mewett, Scott
• Primary Examiner(s): Caldwell, Andrew
• Assistant Examiner(s): KYLE, TAMARA TESLOVICH
• Application Number:
  US09/608,282
• Time in Patent Office: 1,810 Days
• Field of Search: 713/200, 713/201, 713/165, 713/502, 709/223, 709/224, 709/232
• US Class Current: 726/25
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A method and system identifies, fixes, and updates security vulnerabilities in a host computer or host computers. The present invention can communicate between a scanner with plug-in capability, an operating system, and an express update package.

The architectural set-up can allow exploits within the scanner and exploits in the express update package to function with no knowledge of each other. The user also needs no knowledge of whether the exploits are within the scanner or the express update package. Mutual authentication procedures can enable the scanner to load only legitimate express update packages, and can provide that express update packages can only be loaded into legitimate scanners.

Claims

1. A computer-implemented process for identifying security vulnerabilities in a host computer system via a scanner comprising an engine, exploit manager, resource manager, and built-in exploits, comprising the steps of:

updating a capability of the scanner to conduct vulnerability assessments of the host computer system by obtaining a pluggable express update package, wherein the update package is configured as an independent plug-in module that is separate from the scanner and communicates with the scanner to support the vulnerability assessments by the scanner, the update package comprising;

an exploit plug-in module comprising exploit objects for exploits that check the host computer system for at least certain ones of the security vulnerabilities, the exploits representing modifications or updates to the built-in exploits of the scanner;

a resource plug-in module comprising resource objects representing resources that can be used by the scanner, the resources maintained as resource objects separate from the exploits of the exploit objects to support an independent updating of the resource objects and the exploit objects;

a dat file comprising exploit attribute information defining attribute information for the exploits of the exploit plug-in module, the exploit attribute information stored in a file separate from the exploit objects to support an independent updating of the dat file and the exploit objects; and

a help file comprising on-line help information about the exploits of the exploit plug-in module, the help information stored in a file separate from the exploit objects to support an independent updating of the help file and the exploit objects;

supplying the exploit attribute information to the exploit manager from the dat file;

passing the exploit objects and the resource objects from the exploit manager and the resource manager to an engine of the scanner; and

executing the exploits of the exploit plug-in module at the scanner.

2. The computer-implemented process of claim 1 wherein each of said resources can be assigned a namespace based upon the resource'"'"'s scope.

3. The computer-implemented process of claim 1, wherein the step of executing exploits comprises the steps of:

running standard built-in exploits of the scanner;

running standard plug-in exploits of the pluggable express update package;

running denial of service plug-in exploits of the pluggable express update package; and

running denial of service built-in exploits of the scanner.

4. The computer-implemented process of claim 3, wherein said steps of running standard and denial of service built-in exploits of the scanner comprises the steps of:

retrieving one of the built-in exploits at the top of a run-order list maintained by the scanner;

running the retrieved exploit;

recording exploit result information to a database and a scanner log file;

sending the exploit result information to a user interface; and

repeating the above steps for the remaining built-in exploits.

5. The computer-implemented process of claim 3, wherein the steps of running standard and denial of service plug-in exploits of the pluggable express update package comprises the steps of:

copying from a session object a master exploit list and a master resource list;

obtaining exploit information from a scanpolicy object for one of the plug-in exploits;

creating a target object and placing the exploit information in the target object;

passing the target object to one of the exploit objects associated with the plug-in exploit;

running the plug-in exploit;

adding exploit result information to the target object;

passing the target object back to a plug-in engine of the scanner;

querying the target object for the exploit result information;

recording the exploit result information to a scanner log file and sending the exploit result information to a user interface; and

repeating the above steps for the remaining plug-in exploits.

6. The computer-implemented process of claim 5, wherein said step of repeating the above steps for the remaining plug-in exploits comprises the steps of:

running a plug-in exploit that neither produces nor consumes shared resources;

running a plug-in exploit that only produces at least one of the shared resources;

running a plug-in exploit that produces and consumes at least one of the shared resources; and

running a plug-in exploit that only consumes at least one of the shared resources.

7. The computer-implemented process of claim 6, wherein said step of running a plug-in exploit that produces and consumes at least one of the shared resources further comprises the step of ensuring that plug-in exploits that produce at least one of the shared resources consumed by the exploit are run before the plug-in exploit that produces and consumes at least one of the shared resources is run.

8. The computer-implemented process of claim 1, further comprising the step of initializing the scanner.

9. The computer-implemented process of claim 8, wherein the step of initializing a scanner comprises the steps of:

enumerating the exploit plug-in module and the resource plug-in module;

enumerating the exploit objects and the resource objects;

running a load security procedure for the exploit and the resource plug-in modules; and

initializing a policy manager comprising at least one security policy that is retrievable by the engine of the scanner.

10. The computer-implemented process of claim 9, wherein the step of initializing a policy manager comprises the steps of:

identifying available exploits and available resources;

identifying available exploit objects and available resource objects corresponding to the available exploits and available resources;

generating maps that identify the exploit and the resource plug-in modules containing the available exploit objects and the available resource objects;

creating the available exploit objects and the common-setting resource objects; and

querying the available exploit objects and the common-setting resource objects.

11. The computer-implemented process of claim 1, further comprising the step of receiving from a user interface a list of host computer systems the scan engine is authorized to scan, a list of the exploits for execution by the scanner, and the identity of at least one host computer system to scan for security vulnerabilities.

12. The computer-implemented process of claim 1, comprising the step of:

querying a session manager for available hosts to scan;

querying session object for one of the available hosts; and

returning one of the available hosts to a host-scanning thread.

13. A computer-implemented process for identifying security vulnerabilities in a host computer system via a scanner comprising an engine, an exploit manager, a resource manager, standard built-in exploits and denial of service built-in exploits, comprising the steps of:

installing an express update package comprising an exploit plug-in module having exploit objects representing exploits that check the host computer system for vulnerabilities, the exploits comprising standard plug-in exploits and denial of service plug-in exploits;

a resource plug-in module having resource objects representing resources for use by the scanner, a dat file comprising exploit attribute information; and

a help file comprising on-line help information;

supplying the exploit attribute information from the dat file to the exploit manager of the scanner;

passing information about the exploit objects and resource objects from the exploit manager and the resource manager to the scanner engine;

running the standard built-in exploits and the denial of service built-in exploits by the scanner engine;

running the standard plug-in exploits and the denial of service plug-in exploits by a plug-in engine of the scanner, wherein the step of running the standard plug-in exploits and the denial of service plug-in exploits comprises the steps of;

(a) obtaining copies of a master exploit list and a master resource list from a session object;

(b) obtaining exploit information from a scanpolicy object for an identified one of the plug-in exploits;

(c) creating a target object and placing the exploit information in the target object;

(d) passing the target object to one of the exploit objects corresponding to the identified plug-in exploit;

(e) running the identified plug-in exploit;

(f) adding exploit result information to the target object;

(g) passing the target object to the plug-in engine;

(h) querying the target object for the exploit result information;

(i) recording the exploit result information to a scanner log file and sending the exploit result information to a user interface; and

repeating steps (b)-(i) for each of the remaining standard and denial of service plug-in exploits.

14. The computer-implemented process of claim 13, wherein repeating the above steps for the remaining standard and denial of service plug-in exploits comprises the steps of:

running standard and denial of service plug-in exploits that neither produce nor consume at least one of the shared resources;

running standard and denial of service plug-in exploits that only produce at least one of the shared resources;

running standard and denial of service plug-in exploits that produce and consume at least one of the shared resources; and

running standard and denial of service plug-in exploits that only consume at least one of the shared resources.

15. The computer-implemented process of claim 14, wherein said step of running standard and denial of service plug-in exploits that produce and consume at least one of the shared resources further comprises the step of ensuring that standard and denial of service plug-in exploits that produce at least one shared resource consumed by a particular exploit are run before the particular exploit is run.

16. The computer-implemented process of claim 13, further comprising the steps of:

enumerating the exploit plug-in module and the resource plug-in module and the exploit and the resource objects;

running load security for each of the exploit and resource plug-in modules; and

initializing a policy manager comprising at least one security policy that is retrievable by the engine of the scanner.

17. The computer-implemented process of claim 16, wherein initializing a policy manager comprises the steps of:

identifying available exploits and available resources;

identifying available exploit objects and available resource objects corresponding to the available exploits and available resources; and

generating maps that identify the exploit plug-in module and the resource plug-in module containing the available exploit objects and the available resource objects.

18. The computer-implemented process of claim 13, further comprising the step of receiving from the user interface a list of host computer systems that the scanner is authorized to scan, a list of exploits to be used to check the host computer system for security vulnerabilities, and the identity of the host computer system.

19. The computer-implemented process of claim 13, comprising the steps of:

querying a session manager for an identity of at least one host computer system to scan; and

sending the identity of the at least one host computer system to the scanner engine.

20. A computer-implemented process for identifying security vulnerabilities in a host computer system via a scanner comprising a policy manager, an engine, an exploit manager and a resource manager, comprising the steps of:

installing an express update package comprising an exploit plug-in module having exploit objects representing exploits that check the host computer system for vulnerabilities the exploits comprising standard plug-in exploits and denial of service plug-in exploits;

a resource plug-in module having resource objects representing resources for use by the scanner;

a dat file comprising exploit attribute information; and

a help file comprising on-line help information;

initializing the scanner by completing the following steps;

enumerating the exploit plug-in module and the resource plug-in module and the exploit and the resource objects;

running load security for each of the exploit and resource plug-in modules; and

initializing the policy manager, wherein the step of initializing the policy manager comprises the steps of;

requesting the exploit manager and the resource manager to identify available ones of the exploits and the resources;

using the exploit manager and the resource manager to query a registry for available ones of the exploit objects and the resource objects;

creating maps by the exploit manager and the resource manager, the maps identifying the exploit and resource plug-in modules containing the available exploit objects and the available resource objects;

issuing a request to the exploit manager and the resource manager to request the available exploit objects and common-setting resource objects;

returning the available exploit objects and the common-setting resource objects to the policy manager; and

issuing a query from the policy manager to query the available exploit objects and the common-setting resource objects for corresponding exploit attribute information and resource configuration information;

supplying the exploit attribute information to the exploit manager from the dat file;

passing exploit object and resource object information from the exploit manager and the resource manager to the scanner engine; and

executing the exploits at the scanner engine.

21. The computer-implemented process of claim 20, further comprising the step of receiving from the user interface a request to scan at least one host computer system for security vulnerabilities, the request comprising:

a list of host computer systems that the scanner is authorized to scan;

a list of exploits to be used to check the host computer system for security vulnerabilities; and

the identity of at least one host computer system to scan for security vulnerabilities.

22. The computer-implemented process of claim 20, wherein the scanner further comprises built-in exploits comprising standard built-in exploits and denial of service built-in exploits.

23. The computer-implemented process of claim 22, wherein the step of executing exploits at the scanner engine comprises the steps of:

running the standard built-in exploits of the scanner;

running the standard plug-in exploits of the express update package;

running the denial of service plug-in exploits of the express update package; and

running the denial of service built-in exploits of the scanner.

24. The computer-implemented process of claim 23, wherein the steps of running the standard and denial of service built-in exploits of the scanner comprise the steps of:

retrieving one of the built-in exploits at the top of a run-order list maintained by the scanner;

running the retrieved built-in exploit;

recording exploit result information to a database and a log file of the scanner;

sending the exploit result information to a user interface of the scanner; and

repeating the above steps for the remaining built-in exploits.

25. The computer-implemented process of claim 23, wherein the steps of running the standard and denial of service plug-in exploits comprises the steps of:

creating a target object and placing the exploit attribute information in the target object;

passing the target object to one of the exploit objects;

running one of the plug-in exploits;

receiving exploit result information at the target object in response to running the plug-in exploit;

passing the target object back to the engine of the scanner;

recording the exploit result information to a log file of the scanner and passing the exploit result information to a user interface of the scanner; and

repeating the above steps for the remaining plug-in exploits.

26. The computer-implemented process of claim 25, wherein repeating the above steps for the remaining plug-in exploits comprises the steps of:

running a plug-in exploit that neither produces nor consumes shared resources;

running a plug-in exploit that only produces at least one of the shared resources;

running a plug-in exploit that produces and consumes at least one of the shared resources; and

running a plug-in exploit that only consumes at least one of the shared resources.

27. The computer-implemented process of claim 26, wherein the step of running a plug-in exploit that produces and consumes at least one of the shared resources further comprises the step of ensuring that the plug-in exploits that produce at least one shared resource consumed by the plug-in exploit are run before the plug-in exploit that produces and consumes at least one shared resource is run.

28. A computer-implemented process for identifying security vulnerabilities in a host computer system via a scanner comprising an engine, an exploit manager, a resource manager, standard built-in exploits and denial of service built-in exploits, and a user interface, comprising the steps of:

updating a capability of the scanner to conduct security vulnerability assessments of the host computer system by obtaining an update comprising an exploit plug-in module having exploit objects representing exploits that check the host computer system for vulnerabilities, the exploits comprising standard plug-in exploits and denial of service plug-in exploits;

a resource plug-in module having resource objects representing resources for use by the scanner; and

a file comprising exploit attribute information;

installing the update as an independent plug-in for operation in connection with the scanner;

supplying the exploit attribute information from the update to the exploit manager of the scanner;

passing information about the exploit objects and resource objects from the exploit manager and the resource manager to the scanner engine;

running the standard built-in exploits and the denial of service built-in exploits at the scanner engine;

running the standard plug-in exploits and the denial of service plug-in exploits at a plug-in engine of the scanner, wherein the step of running the standard plug-in exploits and the denial of service plug-in exploits comprises the steps of;

(a) obtaining copies of a master exploit list and a master resource list;

(b) obtaining host information and selected ones of the resources for an identified one of the plug-in exploits;

(c) providing the host information and the selected resources via a target object to one of the exploit objects corresponding to the identified plug-in exploit

(e) running the identified plug-in exploit at the plug-in engine;

(f) adding scan result information to the target object in response to running the identified plug-in exploit;

(g) obtaining the scan result information from the target object for presentation via the user interface of the scanner; and

repeating steps (b)-(g) for each of the remaining standard and denial of service plug-in exploits.

29. The computer-implemented process of claim 28, wherein repeating steps (b)-(g) for each of the remaining standard and denial of service plug-in exploits comprises the steps of:

running standard and denial of service plug-in exploits that neither produce nor consume at least one of the shared resources;

running standard and denial of service plug-in exploits that only produce at least one of the shared resources;

running standard and denial of service plug-in exploits that produce and consume at least one of the shared resources; and

running standard and denial of service plug-in exploits that only consume at least one of the shared resources.

30. The computer-implemented process of claim 29, wherein said step of running standard and denial of service plug-in exploits that produce and consume at least one of the shared resources further comprises the step of ensuring that standard and denial of service plug-in exploits that produce at least one shared resource consumed by a particular plug-in exploit are run before the particular plug-in exploit is run.

31. The computer-implemented process of claim 28, further comprising the step of receiving from the user interface:

a list of host computer systems that the scanner is authorized to scan;

a list of exploits to be used to check the host computer system for security vulnerabilities, wherein the list comprises a selection of built-in and plug-in exploits, said selection made from the built-in exploits and the master exploit list; and

the identity of at least one host computer system to scan for security vulnerabilities.

32. The computer-implemented process of claim 28, comprising the steps of:

querying a session manager for an identity of at least one host computer system to scan; and

sending the identity of the at least one host computer system to the scanner engine.

33. The computer-implemented process of claim 28 further comprising the steps of:

enumerating the exploit plug-in module and the resource plug-in module and the exploit and the resource objects;

running load security for each of the exploit and resource plug-in modules; and

initializing a policy manager comprising at least one security policy that is retrievable by the scanner engine.

34. The computer-implemented process of claim 33, wherein initializing a policy manager comprises the steps of:

identifying available exploits and available resources;

identifying available exploit objects and available resource objects corresponding to the available exploits and available resources; and

generating maps that identify the exploit plug-in module and the resource plug-in module containing the available exploit objects and the available resource objects.

35. A computer-implemented process for identifying security vulnerabilities in a host computer system via a scanner comprising an engine, an exploit manager, a resource manager, standard built-in exploits and denial of service built-in exploits, comprising the steps of:

updating a capability of the scanner to conduct security vulnerability assessments of the host computer system by obtaining an update comprising an exploit plug-in module having exploit objects representing exploits that check the host computer system for vulnerabilities, the exploits comprising standard plug-in exploits and denial of service plug-in exploits;

a resource plug-in module having resource objects representing resources for use by the scanner; and

a file comprising exploit attribute information;

installing the update as an independent plug-in for operation in connection with the scanner;

supplying the exploit attribute information from the update to the exploit manager of the scanner;

passing information about the exploit objects and resource objects from the exploit manager and the resource manager to the scanner engine;

running the standard built-in exploits and the denial of service built-in exploits at the scanner engine;

running the standard plug-in exploits and the denial of service plug-in exploits at a plug-in engine of the scanner, wherein the step of running the standard plug-in exploits and the denial of service plug-in exploits comprises the steps of;

(a) obtaining copies of a master exploit list and a master resource list;

(b) obtaining host information and selected ones of the resources for an identified one of the plug-in exploits;

(c) providing the host information and the selected resources via a target object to one of the exploit objects corresponding to the identified plug-in exploit

(e) running the identified plug-in exploit at the plug-in engine;

(f) adding scan result information to the target object in response to running the identified plug-in exploit;

(g) obtaining the scan result information from the target object for storage in a scanner log file; and

repeating steps (b)-(g) for each of the remaining standard and denial of service plug-in exploits.

36. The computer-implemented process of claim 35, wherein repeating steps (b)-(g) for each of the remaining standard and denial of service plug-in exploits comprises the steps of:

running standard and denial of service plug-in exploits that neither produce nor consume at least one of the shared resources;

running standard and denial of service plug-in exploits that only produce at least one of the shared resources;

running standard and denial of service plug-in exploits that produce and consume at least one of the shared resources; and

running standard and denial of service plug-in exploits that only consume at least one of the shared resources.

37. The computer-implemented process of claim 36, wherein said step of running standard and denial of service plug-in exploits that produce and consume at least one of the shared resources further comprises the step of ensuring that standard and denial of service plug-in exploits that produce at least one shared resource consumed by a particular plug-in exploit are run before the particular plug-in exploit is run.

38. The computer-implemented process of claim 35, further comprising the step of receiving from a user interface:

a list of host computer systems that the scanner is authorized to scan;

a list of exploits to be used to check the host computer system for security vulnerabilities, wherein the list comprises a selection of built-in and plug-in exploits, said selection made from the built-in exploits of the scanner and the master exploit list; and

the identity of at least one host computer system to scan for security vulnerabilities.

39. The computer-implemented process of claim 35, further comprising the steps of:

querying a session manager for an identity of at least one host computer system to scan; and

sending the identity of the at least one host computer system to the scanner engine.

40. The computer-implemented process of claim 35, further comprising the steps of:

enumerating the exploit plug-in module and the resource plug-in module and the exploit and the resource objects;

running load security for each of the exploit and resource plug-in modules; and

initializing a policy manager comprising at least one security policy that is retrievable by the scanner engine.

41. The computer-implemented process of claim 40, wherein initializing a policy manager comprises the steps of:

identifying available exploits and available resources;

identifying available exploit objects and available resource objects corresponding to the available exploits and available resources; and

generating maps that identify the exploit plug-in module and the resource plug-in module containing the available exploit objects and the available resource objects.

42. A computer-implemented process for identifying security vulnerabilities in a host computer system via a scanner comprising a policy manager, an engine, an exploit manager and a resource manager, comprising the steps of:

updating a capability of the scanner to conduct security vulnerability assessments of the host computer system by obtaining an update comprising an exploit plug-in module having exploit objects representing exploits that check the host computer system for vulnerabilities, the exploits comprising standard plug-in exploits and denial of service plug-in exploits;

a resource plug-in module having resource objects representing resources for use by the scanner;

a dat file comprising exploit attribute information; and

a help file comprising on-line help information;

installing the update for use by the scanner;

initializing the scanner by completing the following steps;

enumerating the exploit plug-in module and the resource plug-in module and the exploit and the resource objects;

running load security for each of the exploit and resource plug-in modules; and

initializing the policy manager, wherein the step of initializing the policy manager comprises the steps of;

identifying available ones of the exploits and the resources;

identifying the exploit and resource plug-in modules containing the available ones of the exploit objects and the resource objects corresponding to the available exploits and resources;

obtaining the available exploit objects and common-setting resource objects; and

querying the available exploit objects and the common-setting resource objects for corresponding exploit attribute information and resource configuration information;

supplying the exploit attribute information to the exploit manager from the update

passing exploit object and resource object information from the exploit manager and the resource manager to the scanner engine; and

executing the exploits at the scanner engine.

43. The computer-implemented process of claim 42, further comprising the step of receiving from a user interface a request to scan the host computer system for security vulnerabilities, the request comprising:

a list of host computer systems that the scanner is authorized to scan;

a list of exploits to be used to check the host computer system for security vulnerabilities, the list comprising exploits selected from the available ones of the exploits; and

the identity of the host computer system to scan for security vulnerabilities.

44. The computer-implemented process of claim 42, wherein the scanner further comprises built-in exploits comprising standard built-in exploits and denial of service built-in exploits.

45. The computer-implemented process of claim 44, wherein the step of executing exploits at the scanner engine comprises the steps of:

running the standard built-in exploits of the scanner;

running the standard plug-in exploits of the update;

running the denial of service plug-in exploits of the update; and

running the denial of service built-in exploits of the scanner.

46. The computer-implemented process of claim 45, wherein the steps of running the standard and denial of service built-in exploits of the scanner comprise the steps of:

retrieving one of the built-in exploits from a list of built-in exploits maintained by the scanner;

running the retrieved built-in exploit against the host computer system;

recording exploit result information to a database of the scanner;

sending the exploit result information to a user interface of the scanner; and

repeating the above steps for the remaining built-in exploits.

47. The computer-implemented process of claim 42, wherein executing the exploits at the scanner engine comprises the steps of:

creating a target object and placing the exploit attribute information in the target object;

passing the target object to one of the exploit objects;

running one of the plug-in exploits;

receiving exploit result information at the target object in response to running one of the plug-in exploits;

passing the target object back to the scanner engine;

recording the exploit result information to a log file of the scanner and passing the exploit result information to a user interface of the scanner; and

repeating the above steps for the remaining plug-in exploits.

48. The computer-implemented process of claim 47, wherein repeating the above steps for the remaining plug-in exploits comprises the steps of:

running a plug-in exploit that neither produces nor consumes shared resources;

running a plug-in exploit that only produces at least one of the shared resources;

ensuring that the plug-in exploits that produce at least one of the shared resources consumed by the plug-in exploit are run before the plug-in exploit that produces and consumes at least one of the shared resources is run;

running a plug-in exploit that produces and consumes at least one of the shared resources; and

running a plug-in exploit that only consumes at least one of the shared resources.