Emerging Flaws in Legacy Software

One of the top two vulnerabilities of 2021 was PrintNightmare, a vulnerability in the Windows Print Spooler. Print Spooler was a feature that was used for many years to share printers that had to be connected via a Line Printer port to a computer. These ports have not been used in many years, but the service was still enabled by default and was ignored until someone discovered that it could be exploited. The immediate fix for PrintNightmare was to disable the services. The plugin for PrintNightmare checks whether the services are enabled. Many exploits for older, well-established software have led to significant data breaches.

Organizations can be blindsided by a vulnerability in 25-year-old software that is now used throughout most of the Internet. Determined attackers often spend years gathering intelligence on a target’s network before striking in a big way. Tenable provides tactical scan templates and widget templates for many well-known legacy vulnerabilities.

Vulnerabilities and Misconfigurations

Embedded devices are known to leverage shared libraries and third party code and as a result may be affected by the vulnerabilities and misconfigurations in the list below. The 2021 Threat Landscape Retrospective Tenable Vulnerability Management dashboard identifies vulnerabilities to enable users to proactively mitigate any risk for sensitive control systems or Operational Technology (OT). OT Security can detect flaws that lead to exploitation of the vulnerabilities across libraries and Software Development Kits (SDKs) found in billions of OT devices.

URGENT/11 Ripple20 AMNESIA:33 NUMBER:JACK NAME:WRECK NUCLEUS:13 INFRA:HALT BadAlloc PwnedPiper

Security standards, such as PCI DSS and NIST require organizations to manage a system development life cycle that includes software updates, but it is not always possible to update embedded devices.