Prophecy International is reviewing the impact of the CPU vulnerability. On initial assessment, the enterprise agents should not be affected as they will rely on the Operating system to be patched. The Snare Central Server will require a patch from Ubuntu which is slated to be released 9th January 2018. This patch will be incorporated […]Read More
Snare. The world standard for effectively gathering and filtering IT-event data for critical security monitoring, analysis, auditing and archiving.
Snare Central Server does not use Apache Struts, and therefore not affected by this vulnerability. Struts uses the Apache foundation and Java which we don't use in the Snare Central Server application. More information is available here: CVE-2017-9805Read More
All versions of Samba from 3.5.0 onwards are potentially vulnerable to a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writeable share, and then cause the server to load and execute it. The Snare Server is not vulnerable, since it does not export any writeable shares. However, a […]Read More
So you think you have a free copy of the Snare agent somewhere and then it goes all wrong? A potentially unwanted program (PUP), Snarer.dll, with the InterSect Alliance digital signature exists out there, perhaps downloaded with other software. If this happens to you refer to https://howtoremove.guide/snarer-dll-virus-remove/ to remove the virus. How to Avoid this? […]Read More
A vulnerability was found by security company Arthrocyber in the Enterprise version of Epilog Snare Unix agent ( CVE Details ). After some internal investigation it was found that this vulnerability also existed in the Snare Enterprise Epilog Agent for Windows, which can trigger the agents to display the Cross Site Scripting (XSS) attack from […]Read More
The Snare Server utilises a hardened, and minimised Linux installation based on Ubuntu 14.04 to provide baseline computing services. This means that often, security vulnerabilities that impact a general purpose operating system, do not affect the Snare Server, or have a significantly reduced severity. There has been some recent press about the BADLOCK vulnerability affecting […]Read More
A vulnerability was found by Aaron Lesmeister of HALOCK Security Labs in the OpenSource Snare for Windows agent. After some internal investigation it was found that this vulnerability, also existed in the Snare Enterprise Agent for Windows, which can trigger the agents to display the Cross Site Scripting ( XSS) attack from the agents latest […]Read More
The 7.1 Snare Server patch (released 19th February 2016) includes the patching of the latest libc DNS vulnerability that was announced on February 17th https://www.us-cert.gov/ncas/current-activity/2016/02/17/GNU-glibc-Vulnerability and http://www.ubuntu.com/usn/usn-2900-1/. The libc is patched to version 2.19 Return to Knowledge Base.Read More
A vulnerability was found by Dmitry Yudin of Digital Security in the Snare for Windows and the Snare for MSSQL agents. After some internal investigation it was found that this vulnerability and a variation, also existed in some of the other versions of the Snare agents, which can trigger the agents to hang or to […]Read More
Official Response from InterSect Alliance regarding the Heartbleed bug and how it affects the Snare product suite.
Background The Heartbleed Bug is a serious vulnerability in the OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used over networks. It has been designated as CVE-2014-0160, and more information can be found at: http://heartbleed.com/. Only OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable, with all […]Read More