Site: https://www.microfocus.com/en-us/home-1OWASP Top 10 Application Security Risks - 20132/4/2019 2:02:07 PM00:02:01.0386874Info10028https://www.microfocus.com:443/en-us/homehttpswww.microfocus.com443103020Cache Management: HeadersSummaryImplicationExecutionFixFor Development:
Verify your application does not display different content based on headers, and if necessary, re-scan with appropriate headers to ensure good coverage.

For Security Operations:
Evaluate if content negotiation is truly being used, and disable if it is unnecessary. Re-scan with appropriate headers to ensure good coverage.

For QA:
This requires a server or application configuration change. Contact Security Operations for assistance with the server.]]>
Reference InfoW3C RFC 2616 Header Field Definitions
http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.44]]>
;rel="preconnect",;rel="preconnect",;rel="preconnect",;rel="preconnect" Micro Focus Enterprise Application Software: IT Management Solutions | Micro Focus

Discover Micro Focus

Enterprise-grade scalable software with analytics built in.

We address our customers' biggest challenges across the full spectrum of Hybrid IT.
Learn more
We have global scale serving 98 of the Fortune 100 companies.
Discover who
We drive customer-centered innovation and demand excellence from our teams.
Learn more

Discover our innovative solutions

From mainframe to mobile, we have the portfolio depth and breadth to cover challenges across Enterprise DevOps, Hybrid IT Management, Security, Risk & Governance, and Predictive Analytics.

Powering over 40,000 companies across the globe

AIG logo
Fannie Mae
Comcast logo


Finansbank gathers 120GB from 15,000 data sources to identify security anomalies.

Read the case study

Die Mobiliar increases user satisfaction by lowering mean time to resolution by 50%.

Read the case study

ICC helps reduce risk through better understanding, cleanup and control of information.

Read the case study

Customer-centered innovation is at the heart of our culture



Our talented team thrives on solving the problems that matter to you most. We turn ideas into solutions that solve your most complex enterprise-scale challenges. We take pride in building quality products so that you can get the most out of your investment in us.

We help you bridge the old and the new so that you can take advantage of all technologies from mainframe to mobile.


Upcoming events


ITOM Summit 2019
February 5-7, 2019
Phoenix, AZ
Secure Content Management Workshop
February 14, 2019
Johannesburg, South Africa
Micro Focus Technical Workshop
February 12-14, 2019
Trenton, NJ
RSA Conference 2019
March 4-8, 2019
San Francisco, CA
Think 2019
February 12-15 2019
San Francisco, CA
LegalTech
January 29, 2019
New York, NY

View all events
release-rel-2019-1-2-hotfix-1609 | Wed Jan 30 13:31:54 PST 2019
1609
release/rel-2019-1-2-hotfix-1609
Wed Jan 30 13:31:54 PST 2019
]]>
Vulnerability10028https://www.microfocus.com:443/en-us/homehttpswww.microfocus.com443113061Cache Management: Insecure PolicySummaryCache-Control: public would instruct the browser to persistently cache the content on the hard drive. Caching can be prevented by specifying one of the following three directives in the response headers
  • Cache-control: private
  • Cache-Control: no-cache
  • Cache-Control: no-store
]]>
Implication
SSL provides secure encrypted channel to transfer information from source to user. The information server over SSL is considered sensitive and trusted to be only available to requestor. However, caching these content on disk in temporary internet files or in intermediate proxy server can compromise that trust by exposing it to everyone who has access to these temporary storage or proxy cache. Content served over SSL should have cache disabled. ]]>
ExecutionCache-Control header value.]]>FixCache-Control directive to private, no-cache and/or no-store.

private
This directive allows the server to prevent a shared cache from caching responses that are intended for a single user. The mechanism can be used to ensure that privileged information is not accidentally leaked to unauthorized users. The directive may still allow caching of responses by non-shared caches.

no-cache
For sensitive resources requiring user authentication, servers can send the no-cache directive to prevent caches from serving a cached response without first requiring the user agent to validate the user identity. This directive can be specified with or without field names. When no field names are included, this directive applies to the entire request or response.
When one or more field names are specified in the no-cache directive, the response is can be cached but the specified field(s) must be excluded. If the response must include the specified field, then the cache must ensure that the request triggers a revalidation with the origin server.
Example: Cache-Control: no-cache="Set-Cookie"
This directive can be used to ensure sensitive information leakage by requiring the server to confirm the user identity before serving the protected information.

no-store
To completely disable caching of requests or responses, the server must specify the no-store directive in the Cache-Control header. This directive applies to the entire request and response regardless of whether the directive is sent in the request or the response.
]]>
Reference InfoServer Configuration:
IIS
Apache

HTTP 1.1 Specification:
HTTP Header Field Definitions

OWASP:
Browser Cache FAQ

HTTP Caching:
Tutorial
]]>
;rel="preconnect",;rel="preconnect",;rel="preconnect",;rel="preconnect" Micro Focus Enterprise Application Software: IT Management Solutions | Micro Focus

Discover Micro Focus

Enterprise-grade scalable software with analytics built in.

We address our customers' biggest challenges across the full spectrum of Hybrid IT.
Learn more
We have global scale serving 98 of the Fortune 100 companies.
Discover who
We drive customer-centered innovation and demand excellence from our teams.
Learn more

Discover our innovative solutions

From mainframe to mobile, we have the portfolio depth and breadth to cover challenges across Enterprise DevOps, Hybrid IT Management, Security, Risk & Governance, and Predictive Analytics.

Powering over 40,000 companies across the globe

AIG logo
Fannie Mae
Comcast logo


Finansbank gathers 120GB from 15,000 data sources to identify security anomalies.

Read the case study

Die Mobiliar increases user satisfaction by lowering mean time to resolution by 50%.

Read the case study

ICC helps reduce risk through better understanding, cleanup and control of information.

Read the case study

Customer-centered innovation is at the heart of our culture



Our talented team thrives on solving the problems that matter to you most. We turn ideas into solutions that solve your most complex enterprise-scale challenges. We take pride in building quality products so that you can get the most out of your investment in us.

We help you bridge the old and the new so that you can take advantage of all technologies from mainframe to mobile.


Upcoming events


ITOM Summit 2019
February 5-7, 2019
Phoenix, AZ
Secure Content Management Workshop
February 14, 2019
Johannesburg, South Africa
Micro Focus Technical Workshop
February 12-14, 2019
Trenton, NJ
RSA Conference 2019
March 4-8, 2019
San Francisco, CA
Think 2019
February 12-15 2019
San Francisco, CA
LegalTech
January 29, 2019
New York, NY

View all events
release-rel-2019-1-2-hotfix-1609 | Wed Jan 30 13:31:54 PST 2019
1609
release/rel-2019-1-2-hotfix-1609
Wed Jan 30 13:31:54 PST 2019
]]>
Best Practices10028https://www.microfocus.com:443/en-us/homehttpswww.microfocus.com443103440Weak Cryptographic HashSummaryImplicationHashes produced by the MD family should only be used for short-lived uses where the hash and/or hashed data is not highly security sensitive, or for uses where uniqueness is not a critical requirement. MD Hashes should not be used for any type of long term application such as verifying the integrity of a file or for password storage.]]>ExecutionFixFor Development:
The application should only use cryptographically secure hashing algorithms, such as SHA-224, SHA-256, SHA-384, or SHA-512. Hashes representing sensitive data should be salted to reduce the effectiveness of rainbow tables.

For Security Operations:
Implement a security policy that precludes the use of MD5, MD4, or MD2 for cryptographic functionality.

For QA:
Make sure that the application is not relying on MD5, MD4, or MD2 for cryptographic functionality.]]>
Reference InfoMD5
http://en.wikipedia.org/wiki/MD5
Cryptographic Salting
http://en.wikipedia.org/wiki/Salt_%28cryptography%29
]]>
;rel="preconnect",;rel="preconnect",;rel="preconnect",;rel="preconnect" Micro Focus Enterprise Application Software: IT Management Solutions | Micro Focus

Discover Micro Focus

Enterprise-grade scalable software with analytics built in.

We address our customers' biggest challenges across the full spectrum of Hybrid IT.
Learn more
We have global scale serving 98 of the Fortune 100 companies.
Discover who
We drive customer-centered innovation and demand excellence from our teams.
Learn more

Discover our innovative solutions

From mainframe to mobile, we have the portfolio depth and breadth to cover challenges across Enterprise DevOps, Hybrid IT Management, Security, Risk & Governance, and Predictive Analytics.

Powering over 40,000 companies across the globe

AIG logo
Fannie Mae
Comcast logo


Finansbank gathers 120GB from 15,000 data sources to identify security anomalies.

Read the case study

Die Mobiliar increases user satisfaction by lowering mean time to resolution by 50%.

Read the case study

ICC helps reduce risk through better understanding, cleanup and control of information.

Read the case study

Customer-centered innovation is at the heart of our culture



Our talented team thrives on solving the problems that matter to you most. We turn ideas into solutions that solve your most complex enterprise-scale challenges. We take pride in building quality products so that you can get the most out of your investment in us.

We help you bridge the old and the new so that you can take advantage of all technologies from mainframe to mobile.


Upcoming events


ITOM Summit 2019
February 5-7, 2019
Phoenix, AZ
Secure Content Management Workshop
February 14, 2019
Johannesburg, South Africa
Micro Focus Technical Workshop
February 12-14, 2019
Trenton, NJ
RSA Conference 2019
March 4-8, 2019
San Francisco, CA
Think 2019
February 12-15 2019
San Francisco, CA
LegalTech
January 29, 2019
New York, NY

View all events
release-rel-2019-1-2-hotfix-1609 | Wed Jan 30 13:31:54 PST 2019
1609
release/rel-2019-1-2-hotfix-1609
Wed Jan 30 13:31:54 PST 2019
]]>
VulnerabilityCUSTOMhttps://www.microfocus.com:443/en-us/homehttpswww.microfocus.com44347282Cookie Security: Persistent CookieSummarysession cookies and persistent cookies. Session cookies only live in the browser's memory, and are not stored anywhere. Persistent cookies, however, are stored on the browser's hard drive. This can cause security and privacy issues depending on the information stored in the cookie and how it is accessed.]]>ImplicationPersistent cookies are stored on the browsing clients hard drive even when that client is no longer browsing the Web site that set the client. Depending on what information is stored in the cookie, this could lead to security and privacy violations. The Office of Management and Budget has decreed that no federal websites shall use persistent cookies except in very specific situations.]]>ExecutionAll cookies are set by the server via the Set-Cookie HTTP Header. A browser knows to store that cookie as a persistent cookie when it finds the keyword 'Expires=' followed by a date in the future. If there is no 'Expires=' tag, or if the specified date has already passed, then the browser will keep the cookie in memory only as a session cookie.

To view the persistent cookie set on this page, view the HTTP response and examine the Set-Cookie header. You should see the 'Expires=' tag with a future date specified.]]>
FixFrom a coding perspective, the only distinction between a session cookie and a persistent cookie is the 'Expires=' tag that specifies when a persistent cookie should expire. If a cookie has no 'Expires=' tag, then it is automatically interpreted as a session cookie. Removing the expiration date from the code that sets the cookie will change it to a session cookie.]]>Reference InfoWhite House Office of Management and Budget:
Memorandum M-00-13 Privacy Policies and Data Collection on Federal Web Sites

Microsoft Knowledgebase Article:
Description of Persistent and Per-Session Cookies in Internet Explorer.]]>
;rel="preconnect",;rel="preconnect",;rel="preconnect",;rel="preconnect" Micro Focus Enterprise Application Software: IT Management Solutions | Micro Focus

Discover Micro Focus

Enterprise-grade scalable software with analytics built in.

We address our customers' biggest challenges across the full spectrum of Hybrid IT.
Learn more
We have global scale serving 98 of the Fortune 100 companies.
Discover who
We drive customer-centered innovation and demand excellence from our teams.
Learn more

Discover our innovative solutions

From mainframe to mobile, we have the portfolio depth and breadth to cover challenges across Enterprise DevOps, Hybrid IT Management, Security, Risk & Governance, and Predictive Analytics.

Powering over 40,000 companies across the globe

AIG logo
Fannie Mae
Comcast logo


Finansbank gathers 120GB from 15,000 data sources to identify security anomalies.

Read the case study

Die Mobiliar increases user satisfaction by lowering mean time to resolution by 50%.

Read the case study

ICC helps reduce risk through better understanding, cleanup and control of information.

Read the case study

Customer-centered innovation is at the heart of our culture



Our talented team thrives on solving the problems that matter to you most. We turn ideas into solutions that solve your most complex enterprise-scale challenges. We take pride in building quality products so that you can get the most out of your investment in us.

We help you bridge the old and the new so that you can take advantage of all technologies from mainframe to mobile.


Upcoming events


ITOM Summit 2019
February 5-7, 2019
Phoenix, AZ
Secure Content Management Workshop
February 14, 2019
Johannesburg, South Africa
Micro Focus Technical Workshop
February 12-14, 2019
Trenton, NJ
RSA Conference 2019
March 4-8, 2019
San Francisco, CA
Think 2019
February 12-15 2019
San Francisco, CA
LegalTech
January 29, 2019
New York, NY

View all events
release-rel-2019-1-2-hotfix-1609 | Wed Jan 30 13:31:54 PST 2019
1609
release/rel-2019-1-2-hotfix-1609
Wed Jan 30 13:31:54 PST 2019
]]>
Info10028https://www.microfocus.com:443/httpswww.microfocus.com443103020Cache Management: HeadersSummaryImplicationExecutionFixFor Development:
Verify your application does not display different content based on headers, and if necessary, re-scan with appropriate headers to ensure good coverage.

For Security Operations:
Evaluate if content negotiation is truly being used, and disable if it is unnecessary. Re-scan with appropriate headers to ensure good coverage.

For QA:
This requires a server or application configuration change. Contact Security Operations for assistance with the server.]]>
Reference InfoW3C RFC 2616 Header Field Definitions
http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.44]]>