Virsec Security Platform (VSP) leverages the patented Trusted Execution™ technology to protect high-value enterprise applications deployed in data center or on public and hybrid clouds, from highly sophisticated attacks including memory corruption, code injection, credential theft, supply chain and other sophisticated attacks. VSP effectively creates and enforces guardrails around the application as it executes. These guardrails ensure that applications only perform as intended and restrain bad actors from corrupting memory as a precursor to hijacking control of the application and subsequent stealing or destroying high-value enterprise data.

 

 

DATE OF RELEASEDATE OF RELEASE

 

11/14/2022

COMPATIBILITY MATRIXCOMPATIBILITY MATRIX

 

Refer to the topic Compatibility Guide  for information related to the Supported platforms and languages.

 

NEW FEATURESNEW FEATURES

  1. Platform and CMS Enhancements:

    1. CMS UI has improvements to ease the Application creation process:

      1. The LFI and RFI Profiles are optional

      2. The vulnerabilities CSRF and DOM XSS are beta features

      3. No information is now required for Application Type "Other"

    2. The Probe deployed time is now displayed on CMS Probes screen

    3. Terminology Change – "Application Service" and "Web Service" are now "Application Server" and "Web Server"

    4. Incremental LFR Sync: VSP now supports incremental LFR sync instead of a complete refresh during an upgrade. Refer Container/VM links for more information

  2. Compatibility Enhancements:

    1. Host Protection: VSP now provides support to Windows 2003. Refer to the Compatibility Matrix for more information

  3. Memory Exploit Protection: Protection against critical OS memory dumping of services like LSASS for credentials access. Refer Section Memory Exploit Protection in Operations for more information

FIXESFIXES

 

Defect ID

Description

SUPP-300

When the FSM "Deployment Folder" is configured and Protection Action is assigned to the Security Policy, the provisioning of the VSP-Memory wrapper is quarantined and fails. FSM tickets may not be produced in some environments

SUPP-426

Stopping Maintenance mode resulted in Scan Error on some servers

SUPP-462

Windows Strict v2.5 ACP generates 1400 incidents per hour due to two patterns included in the policy

SUPP-465

The field "Updated By" for all system alerts related to Maintenance mode displays the value "SYSTEM"

SUPP-466

Many legitimate processes and libraries are reported in CMS as incidents

SUPP-467

DETECT mode on Win2012r2 cause host inaccessibility (RDP is not possible) and programs become unusable (services.msc cannot be started or VSP probe cannot be uninstalled)

SUPP-470

High memory consumption by VSP services on Windows server

SUPP-479

Application landing page displays error. It works as expected when Application provisioning is stopped

SUPP-482

Trusted publisher's process with valid cert is reported as an unknown process

SUPP-497

Update the Instance size for VM-based setup on EC2 docs

SUPP-502

Errors encountered while viewing AE Stats using VSP-CLI

SUPP-508

DotNet Application does not move to normal state

SUPP-515

Update 2.5.0 docs with port 9093 when secure kafka is enabled

SUPP-516

Stored XSS attacks for legitimate payload is blocking application

SUPP-520

Tomcat Application crashed due to insufficient memory for the JRE

SUPP-526

High resource usage is observed after enabling Detect mode on a host

SUPP-533

Windows 2019 - Windows Strict ACP 2.6.0 blocks a legitimate process

SUPP-541

Insufficient RAM error encountered for CMS on AWS

SUPP-545

Windows-Strict ACP v2.6.1 has typo error: BCDEDIT<space>.exe

SUPP-546

Server Connectivity Issues encountered after VSP Probe Upgrade

SUPP-560

Port-related issues are encountered with reporting functionality

Table – VSP 2.6.0 Fixes 

KNOWN ISSUES AND CAVEATSKNOWN ISSUES AND CAVEATS

 

Category

Description

Known Issue/ Caveat

Installation

CI phase fails on Ubuntu 20 container

CI phase fails on Ubuntu 20 container if the docker version 19.03.0 - 19.03.8 is installed on the Management node used for installation. This is due to a known issue in these docker versions

Recommended Workaround: Install docker version: 19.03.9 on the Management Node

Known Issue

FSM (File System Monitoring)

File Rename incident is detected with "fileName" and "filePath" as "NON_MONITORED_PATH"

For a File rename incident, "fileName" and "filePath" attributes are reported as "NON_MONITORED_PATH" after deletion of the file contents

Known Issue

Duplicate incidents and events are generated after file modification

Duplicate incidents and events are generated after modification of an existing or new file with event types NEW_FILE, FILE_MODIFIED and FILE_RENAMED

Known Issue

(Windows 2008) Two incidents are generated for file rename action

For a file rename action, two Incidents FILE_RENAME and FILE_MODIFIED are reported in Windows 2008

Known Issue

Incidents are reported for excluded folders

When multiple Applications are associated with the same ASI and a few folders are excluded in one of them and not the others, incidents are reported for the excluded folders

Recommended Action: Ensure that the folders are excluded in all the associated Applications on CMS

Known Issue

VSP-Memory

Post BE attack, process may not restart for VM

Post BE attack, if an application is configured in the inline protect restart mode, it may not get restarted successfully.

Recommended Workaround: sudo must be present on the machine and must not require a password to execute when launched as root user

Known Issue

Apache 2.4 (httpd) is not instrumented when it is started as a service (Win 2016)

 

httpd service is not instrumented when it is started as a service. The process terminates.

Recommended Workaround: Do not start httpd as a service. Execute it from the console

Known Issue

(Windows) VSP-Memory fails to automatically re-instrument an Application sometimes

In Windows, when using auto-instrumentation for a service, VSP-Memory sometimes fails to re-instrument the application automatically, if the service is restarted via the Services window. This is because VSP-Memory-Assist does not process the application stop/start quickly enough

Recommended Workaround: In such cases, stop the service, wait up to 5 seconds before starting the service

 
Known Issue

Host Monitoring

All entries in the Global exclusion list are considered regular expression patterns

All entries in the Global exclusion list are considered regular expression patterns even if there are absolute paths present

Known Issue

SearchUI.exe process gets suspended on Windows Server 2016 SearchUI.exe process gets suspended on Windows Server 2016. This is a behavior of the specific OS Caveat
VSP-CLI logs error in Mixed Mode

In Mixed Mode, VSP-CLI logs error: “ERROR: ld.so: object 'libvsp-hmm-agent.so' from /etc/ld.so.preload cannot be preloaded: ignored.”
It has no adverse effect on the VSP-CLI functionality.

Caveat

Some publishers did not get detected/Allowlisted during initial scan

Upon launch, Google Chrome browser, some libraries (signed by publisher 'ESET, spol. s r.o.') are loaded. The publisher is not listed in the publishers list in the initial scan. When the process is launched, this publisher gets allowlisted automatically (if auto-allowlist is enabled)

Expected Behavior

Suspended signed process is not resumed (Windows)

After the initial scan, when a new process is installed, it gets suspended in Protect Mode. When the publisher is allowlisted, the process is not resumed.

Recommended Workaround: Allowlist the specific process associated with the profile.

Known Issue

VSP does not report modified processes or libraries that belong to a package in systems that use prelink

VSP does not report modified processes or libraries that belong to a package in systems that use prelink. The prelink application inherently changes the binary checksum, so there is no true reference for VSP to use.

Expected Behavior

In Windows, when an application is started with or without the “.exe”, different detections by VSP may be possible

ACPs are specific to the command lines used when starting an application. In Windows, when an application is started with or without the ".exe", different detections by VSP may be possible

Known Issue

App Control Policies do not support any unicode character in any field

App Control Policies do not support any unicode character in any field

Limitation

Linux HMM agent limitation

In Linux, VSP host monitoring injects its own HMM agent into every running process. The HMM agent expects a specific version of glibc. If the application loads its own custom glibc version that is not compatible with the HMM agent, the HMM agent may not load correctly causing some application issues

Limitation

Exclusion on Child Type ACP rule does not work

Even when a child process added under exclusion in ACP, Child Exclusion is reported as incident

Known Issue

Incident is not reported when the user name is a mismatch

Incident is not reported when the user name does not match the "Allow" user in ACP config

Known Issue

Publisher/Package list is not included when the host profile is exported

Publisher/Package list is not included when the host profile is exported. As a result, when the host profile is imported into CMS, the publisher/packages list may be missing and may generate incidents.

Limitation

Fully statically-linked executables are not detected during the start up by HMM

Fully statically-linked executables are not detected during the start up by HMM. However, whenever the allowlist is published or there is a VSP host mode change, VSP host detects and checks the actively running statically-linked executables

Known Issue

For a small subset of applications started via the "service" command in Linux, VSP host does not detect the application start

In some cases, for a small subset of applications started via the "service" command in Linux, VSP host does not detect the application start, resulting in a potential false negative. However, each time the allowlist is published or the VSP host mode is changed, VSP host scans the system, that detects the running application if it is still running

Known Issue

"Access denied" message is not displayed when a process is blocked

"Access denied" message is not displayed when a process is blocked on Windows 2003 OS (32bit and 64 bit)

Known Issue

Out of box protection actions are not available for Windows 2003 servers

Out of box protection actions are not available for Windows 2003 servers

Known Issue

Execution of native image DLLs by Windows CLR runtime is not covered

Execution of native image DLLs by Windows CLR runtime is not covered under Virsec Process and Library Monitoring capabilities

Known Issue

"Stop Maintenance Mode" functionality is not working as expected

Incidents are reported after stopping the maintenance mode for Python.exe that was installed during maintenance

Known Issue

Windows 2003: Unverified Process with long directory or process name is not blocked

Unverified Process with long directory or process name is not blocked on Windows 2003 servers (32 and 64 bit)

Known Issue

Reporting

On premise Kubernetes - based deployment:Generated Reports cannot be viewed

In an on-premise Kubernetes - based multi-pod deployment, generated reports cannot be viewed. Error 404 is displayed. This occurs when the components JReports and Ngnix Client service are deployed on different worker nodes

Known Issue

Reports are not generated when the Report name contains a special character Reports are not generated when the Report name contains a special character except "-" and "_" Known Issue
The error, "Unable to connect to the Report Server" is displayed in CMS while scheduling a report

The error may be due to the occurrence of SQL connectivity error in the JReports Server.

Recommended Workaround: If the error SQLNonTransientConnectionException is found, restart the JReports server

Known Issue

VSP-Web (on Web Server)

Compressed Responses are not supported

VSP-Web (on Web Server) does not support compressed Responses.Example: gzip

Limitation

VSP-Web

Long polling or WebSocket based requests are not supported

Long polling or WebSocket based requests are currently not supported by VSP Web

Limitation

Asynchronous servlet model is not supported

Applications leveraging Async-API are not supported

Limitation

Permission denied message is displayed along with the Application message

For some inline protection cases, along with the Permission Denied pop-up message, the application response is also displayed

Known Issue

VSP 2.6.0: VSP-Web for Ruby is not backward compatible

VSP-Web for Ruby on Rails is not backward compatible for 2.4.x and lower

Impact: It impacts VSP-Web for Ruby, where CMS is upgraded to VSP 2.5 or higher and Probe is still of a previous version

Recommended Workaround: Ensure that VSP Probe is also upgraded to version 2.5 or higher

Limitation

RFI profile exclusion list is not considered for perimeter level RFI attack

RFI profile exclusion list is not considered for perimeter level RFI attack

Recommended Workaround: Add the relevant exception to circumvent the issue

Known Issue

Web Protection (On Web Server)-Apache – pop-up is not displayed

Web Protection (On Web Server)-Apache: Permission denied popup is not displayed. The request is blocked as expected with no impact to functionality

Known Issue

.Net Core: VSP deletes comments from the file web.config

.Net Core: While provisioning application, VSP deletes comments from the file web.config of the application

Known Issue

Invalid CSRF token is reported to CMS when two j-session IDs are present

Invalid CSRF token is reported to CMS when two j-session IDs are sent in the request. VSP supports monolithic applications only. This occurs with multiple session providers only

Known Issue

VSP Memory Exploit Protection

RMP does not detect a variant of PowerShell Exploit

RMP does not detect a variant of PowerShell Exploit if both the source and target processes are the same

Limitation

RHEL 7.6: Process name in Memory integrity incidents is inaccurate for watch command

Process name in Memory integrity incidents is displayed as bash instead of the target process name for watch command

Known Issue

Multiple incidents are reported for powershell

Multiple incidents are reported for powershell since Windows attempts to spawn a new powershell with a shortened path and VSP blocks all these attempts

Expected Behavior

Regex-based exclusions are not supported

Regex-based exclusions are not supported currently

Limitation

Some Exploits are reported as Process Hollowing due to shared API

Exploits such as Credential API Hooking, TLS Callback Injection and Thread Execution Hijack can be reported as Process Hollowing due to the sharing of API calls with Process Hollowing in Windows 2016 and Windows 2019 machines

Known Issue

Two events are detected as part of the OS Credential Dumping attack

Utility tools like ProcDump used to collect memory dump of a process, clones the target process before creating the dump file when used with the recursive flag (-r). In such cases, two events are generated, one for the original process and the other for the cloned process. Both the events are detected as part of the OS Credential Dumping attack coverage

Known Issue

General

VSP-CLI command gives error while executing stop/restart VSP-Manager service

When VSP-CLI command is used to stop/restart VSP-Manager service (individually or all the services), there is an error “Exception occurred during the initialization of the VSP Kafka consumer”

Recommended Workaround: Close the current session and stop/restart the VSP-Manager service in a new session

Known Issue

For VSP CMS on an AWS environment ensure that only the External Email server is configured

For VSP CMS on an AWS environment ensure that only the External Email server is configured

Limitation

Email Subscription for application-based incidents

If any application-based incident is configured for Email Subscription, ensure that the Host is NOT selected

Known Issue

VSP is not supported for workloads running SELinux in Enforcing mode

VSP is not supported for workloads running SELinux in Enforcing mode

Limitation

CMS dashboard is not displayed for LDAP user with modified email ID It is highly recommended to use email as the unique login attribute in the LDAP configuration. If CN is configured and the email ID is modified, CMS does not load the dashboard for that user Known Issue
Emails configured with spaces in LDAP are not supported Emails configured with spaces in LDAP are not supported. In such cases, a “valid object class error” is encountered on CMS LDAP configuration page for the section LDAP User Binding Known Issue
Licenses need to be reloaded after an On-premise license server restart Licenses loaded on the on-premise license server do not persist. Hence once the on prem license server is restarted with CMS restart they need to be reloaded/activated again using the activation id already shared Known Issue

User may be unable to delete instances

User may be unable to delete instances in a larger environment with more than 20 thousand open incidents

Known Issue

Protection Engine: In Windows if the log path contains spaces, log rotation does not work

When the protection engine is configured with protection actions associated with log path contains spaces, log rotation does not work in Windows

Recommended Workaround: Ensure that the configured log path does not contain spaces

Limitation

Table – Known Issues and Caveats