Summary When Software Vulnerability Manager (SVM) scans a device, which has Apache Tomcat webserver installed, the scan results do not show Tomcat to be installed on that device. Diagnosis Software Vulnerability Manager looks for exe, dll and ocx binary file extensions while scanning a device. The metadata in the PE header of these files is used to tie them back to their respective product and version. Apache Tomcat has two installer formats for Windows platform – ZIP and EXE. Upon installing the ZIP format installer on a device, it is seen that there are no exe, dll or ocx files in the install directory. It clearly appears that the ZIP format of the installer does not include any of the binary file formats which SVM can recognize therefore SVM fails to identify Tomcat during scanning a device which has ZIP format installed. The EXE format of the installer installs two .exe files in the install directory. However, the Product Version obtained from the PE header of these files does not match the actual version of Tomcat installed on the device, therefore SVM does not know which version of the product these files belong to and so cannot identify a version of Tomcat installed. As a result, Tomcat will not appear in SVM scan results. For instance: Tomcat.exe and Tomcat10w.exe are the two binary files installed by Tomcat version 10.0.5.0. However, the Product Version seen in the PE header of these two files is 1.2.4.0.   Conclusion The PE header meta data of the binary files installed by any product on a device plays a very crucial role in identifying the correct product name and the version installed. Tomcat’s either missing binary files, or (when present) offers unreliable identification data resulting in SVM’s failure to correctly identify the presence of any Tomcat versions on a device. If interested, we encourage customers to reach out to the creators of Apache Tomcat to fix the version information in binary files to align with the product version installed on a device. Currently there no work around available in SVM to address this deficiency. ... View more

This release adds some significant features to Software Vulnerability Manager: Integration with VMware Workspace ONE Software Vulnerability Manager continues to extend its scope of integration by adding support to yet another industry popular end point management system. SVM now integrates with VMware Workspace ONE to publish SPS and VPM patches. This new capability requires a new version of patch daemon, released as a part of SVM Toolkit that can be downloaded here. QuickPatch Introducing QuickPatch, a new and quick way for non-IE browsers to publish patches from SVM to an end-point management system with no dependency on ActiveX. QuickPatch publishes patches via Patch Daemon using defaults. For full release notes, please click here. ... View more

Software Vulnerability Research March 2021 update is live now. The following product enhancements are added to this update: Enhanced Threat Scoring Several new rules are added to this update to improve how we calculate Threat Scores in order to help you more accurately prioritize patches based upon likelihood of exploitation. As part of this effort, many existing rules have been carefully adjusted to ensure a valuable Threat Score. For more details, please refer this announcement. Other Enhancements Five failed login attempts for accessing SVR APIs via browser will block the account. Only an Administrator has the rights to unblock such accounts. CSV grid export will add a single quote (‘) if a cell contains text which starts with one of the following special characters: =, @, |, %, to avoid any malicious code execution via macros. For full release notes, please click here. ... View more