PRTG 보안 취약 관련 중요 업데이트 안내의 건

대상 범위: PRTG v19.3.52.3502 - v20.1.57.1745

 

안녕하세요 씨큐앤엠입니다.

PRTG의 업데이트 관련 사항을 CVE 코드 관련하여 정리 드립니다. 

당 사는 당초 v19.4.54.1506을 기점으로 운영의 사항을 지원 예정이었으나, 
Paessler AG사로 부터의 보안 패치 관련 운영 안내를 바탕으로,
PRTG v20.1.57.1754 를 기반으로 운영 사항을 정리 하였습니다.
- 한글 인터페이스(Korean by SecuNM v2.0)
- 커스텀 파일 지원 운영.

4월부터, 당 사의 운영 고객사를 지원 대상으로 순차 업데이트를 지원 할 예정입니다.
관련 문의는, 당사로 문의를 바랍니다. 

# PRTG 보안 취약 점검 사항 #

MARCH 24TH 2020 – VERSION 20.1.57.1745

 

SECURITY - SERVER (CVE-2020-10374)
This version includes an important security update for your PRTG core server. We recommend that you update as soon as possible. Please find more details in the email we sent to the email address provided in your license information.

WEBGUI - SECURITY (CVE-2019-8331)
We updated the bootstrap.js plugin that we ship with PRTG because the previously used version 3.2.0 had an XSS vulnerability. 

NOVEMBER 25TH 2019 – VERSION 19.4.54.1506

SECURITY - SERVER (CVE-2019-19119)
This version includes an important security update for your PRTG core server. We recommend that you update as soon as possible. Please find more details in the email we sent to the email address provided in your license information. Special thanks go to Aleksandr Melkikh from Positive Technologies for pointing us to the right direction.

SECURITY - SENSORS (CVE-2019-11073)
We fixed a potential Remote Code Execution (RCE) vulnerability of the HTTP Transaction sensor. 

 

OCTOBER 29TH 2019 – VERSION 19.4.53.1912

 

SECURITY - SENSORS (CVE-2019-11490)
We updated the Npcap library that Packet Sniffer and Packet Sniffer (Custom) sensors use to monitor your traffic. The Npcap version (0.992) distributed with previous PRTG versions included a security issue with an ACE vulnerability.

 

OCTOBER 1ST 2019 – VERSION 19.3.52.3502

SECURITY - SENSORS (CVE-2019-11074)
We fixed a potential Denial of Service (DoS) vulnerability of the HTTP Full Web Page sensor. Please note that the fixed vulnerability required a logged in PRTG user account with elevated rights to be exploited. 

#Paessler_CVE code info