NCIRC Security Tools NIAPC Submission Summary Microsoft Baseline Security Analyzer (MBSA)

Transcription

1 NCIRC Security Tools NIAPC Submission Summary Microsoft Baseline Security Analyzer (MBSA) Document Reference: Security Tools Internal NIAPC Submission NIAPC Category: Operating System Security Management Date Approved for Submission: Evaluation/Submission Agency: NCIRC Issue Number: Draft 0.01 NATO UNCLASSIFIED RELEASABLE TO THE INTERNET

2 TABLE of CONTENTS 1 Product Category Role Overview Certification Company Country of Origin Web Link Product Description Product Requirements Limitations Evaluation/Review Conclusions/Comments...5 NATO UNCLASSIFIED RELEASABLE TO THE INTERNET Page 2 of 5

3 1 Product Microsoft Baseline Security Analyzer (MBSA) versions and Category Operating System Security Management. 3 Role Vulnerability audit and patch reporting. 4 Overview Microsoft Baseline Security Analyzer (MBSA) is an easy-to-use tool designed to determine the security state of MS operating system based computers in accordance with Microsoft security recommendations and offers specific remediation guidance. 5 Certification This product has not undergone certification. 6 Company Microsoft Inc. 7 Country of Origin USA. 8 Web Link 9 Product Description MBSA is compatible with Microsoft Update and Windows Server Update Services and the SMS Inventory Tool for Microsoft Update (ITMU). MBSA offers customers improved Windows component support, expanded platform support for XP Embedded and 64-bit Windows, as well as more consistent and less complex security update management experience. Any update published on Microsoft Update as a security update, update rollup, or service pack can be scanned using MBSA 2.0. These updates have been defined by Microsoft as follows: Security update A broadly released fix for a product-specific security-related vulnerability. Security vulnerabilities are rated based on their severity which is indicated in the Microsoft security bulletin as critical, important, moderate, or low. NATO UNCLASSIFIED RELEASABLE TO THE INTERNET Page 3 of 5

4 Update rollup A tested, cumulative set of hot fixes, security updates, critical updates, and updates packaged together for easy deployment. A rollup generally targets a specific area, such as security, or a component of a product, such as Internet Information Services (IIS). Service pack A tested, cumulative set of all hot fixes, security updates, critical updates, and updates, as well as additional fixes for problems found internally since the release of the product. Service packs may also contain a limited number of customer-requested design changes or features. If you have corporate hotfixes installed on the scanned computer, detection will observe those updates based on file version as determined by Microsoft. Typically files with a newer than expected version would be accepted, unless Microsoft had determined that a higher versioned file was not secure, in which case the update would be offered in the report. Because clients can be scanned using an online source (Microsoft Update or an assigned Update Services server) in addition to the offline catalogue, the report can include a specific heading called "Catalogue synchronization date". If the offline catalogue was used, the time that catalogue was generated is displayed in the report and can be used to determine if the latest catalogue was used. To check the version of the offline catalogue, follow these procedures: Step 1: If you do not have the file, download it from and save it to C:\Documents and Settings\<username>\Local Settings\Application Data\Microsoft\MBSA\2.0\Cache\wsusscn2.cab (default location). Step 2: Open C:\Documents and Settings\<username>\Local Settings\Application Data\Microsoft\MBSA\2.0\Cache\wsusscn2.cab using any program able to view an archive file type of *.cab. Step 3: Open package.cab from the wsusscn2.cab file, and then the package.xml file inside it. Step 4: View the OfflineSyncPackage header element for the CreationDate. It should be set to a value such as " T18:42:49Z" (for example). Use the value you find to determine when the file was generated by Microsoft. 10 Product Requirements Requirements include Remote Registry service, Server service, Workstation service, File and Printer Sharing service, and Automatic Updates service. The wsusscn2.cab file is downloaded from the Microsoft Web site over HTTP based on your Internet Explorer settings. Remote computer scans are performed by using TCP ports 135, 139, and 445. Where a firewall or filtering router separates two networks, TCP ports 135, 139, and 445 and UDP ports 137 and 138 must be open in order for MBSA to connect and authenticate to the remote computer being scanned. 11 Limitations Installs on Microsoft Windows 2000; Windows XP and Windows Server Scanning for administrative vulnerabilities is supported for Microsoft Windows 2000; Windows XP; Windows Server 2003; Microsoft Internet Information Services (IIS) 5.0, 5.1, and 6.0; Microsoft Internet Explorer 5.01, 5.5, and 6.0 (including Internet Explorer 6.0 for Windows XP SP2 and Internet Explorer 6.0 for Windows Server 2003); Microsoft SQL Server 7.0 and SQL Server 2000; and Microsoft Office 2000, Office XP, and Office Scanning for security updates is based on the Microsoft Update catalogue. However, there are several products supported by MBSA that will not be immediately available in Microsoft Update so MBSA 2.0 cannot scan for them: a) Microsoft BizTalk Server 2000, 2002 and 2004 b) Microsoft Commerce Server 2000 and 2002 NATO UNCLASSIFIED RELEASABLE TO THE INTERNET Page 4 of 5

5 c) Microsoft Content Management Server 2001 and 2002 d) Microsoft Host Integration Server 2000, 2004 and SNA Server 4.0 e) Microsoft Office Evaluation/Review Conclusions/Comments A very helpful tool. NATO UNCLASSIFIED RELEASABLE TO THE INTERNET Page 5 of 5