How to remediate – Untangle NG Firewall Detection

1. Introduction

Untangle NG Firewall Detection indicates that Untangle NG Firewall, a firewall and routing application, is present on a remote host. This matters to businesses as firewalls are critical for network security; their presence needs managing and monitoring like any other system. Affected systems typically include servers or virtual machines running the Untangle software. A compromise could lead to loss of confidentiality, integrity, and availability of network traffic.

2. Technical Explanation

The detection simply confirms the installation of Untangle NG Firewall on a host. There is no inherent technical vulnerability being reported at this stage; it’s an inventory finding. Exploitation would depend on vulnerabilities within the Untangle software itself, which are tracked separately. Preconditions for exploitation involve network access to the firewall and potential weaknesses in its configuration or code.

• Root cause: The presence of a third-party application that requires security management.
• Exploit mechanism: Exploitation depends on specific vulnerabilities within Untangle NG Firewall, such as remote code execution flaws or authentication bypasses. An attacker could potentially gain control of the firewall and intercept or manipulate network traffic.
• Scope: Systems running any version of Untangle NG Firewall are affected.

3. Detection and Assessment

• Quick checks: Run ps aux | grep untangle to see if any Untangle processes are active.
• Scanning: Nessus plugin ID 14927 can detect the presence of Untangle NG Firewall, but this is an example only and may require updating.
• Logs and evidence: Check system logs for entries related to Untangle installation or startup. The location varies depending on the operating system.

ps aux | grep untangle

4. Solution / Remediation Steps

The solution depends on your security policy regarding third-party firewalls. If you approve of its use, ensure it is properly configured and patched. If not, remove the software.

4.1 Preparation

• Change window: A standard change window may be needed, with approval from the security team.

4.2 Implementation

1. Step 1: If removing, uninstall Untangle NG Firewall using the operating system’s package manager or control panel.
2. Step 2: Reboot the host system to ensure all components are removed.

4.3 Config or Code Example

This vulnerability does not involve a specific configuration error; it’s about the presence of software.

Before

Untangle NG Firewall is installed and running.

After

Untangle NG Firewall is uninstalled and no processes are running.

4.4 Security Practices Relevant to This Vulnerability

Practices that address this vulnerability type include asset management and patch cadence.

• Practice 1: Maintain a complete inventory of all software installed on your network, including firewalls.
• Practice 2: Implement a regular patch cycle for all third-party applications to address known vulnerabilities.

4.5 Automation (Optional)

No automation is provided as this relates to software management.

5. Verification / Validation

Confirm the fix by checking that Untangle NG Firewall is no longer present on the system. Perform a service smoke test to ensure network connectivity is unaffected.

• Post-fix check: Run ps aux | grep untangle; there should be no output.
• Re-test: Re-run the initial detection steps (see section 3) and confirm that Untangle NG Firewall is not detected.
• Smoke test: Test basic network connectivity by pinging an external website or accessing a shared resource.

ps aux | grep untangle

6. Preventive Measures and Monitoring

Preventive measures include updating security baselines and adding checks in CI/CD pipelines.

• Baselines: Update your security baseline to reflect approved software lists or restrictions on third-party firewalls.
• Pipelines: Add a check in your deployment pipeline to scan for unauthorized software installations.
• Asset and patch process: Review the asset inventory weekly, and ensure all systems are patched within 30 days of release.

7. Risks, Side Effects, and Roll Back

Removing Untangle NG Firewall could disrupt network connectivity if no alternative solution is in place. Roll back by restoring from backup or reinstalling the software.

• Roll back: Restore the host system from a pre-change backup, or reinstall Untangle NG Firewall using the original installation media.

8. References and Resources

Links to official advisories and documentation.

• Vendor advisory or bulletin: https://www.untangle.com/untangle-ng-firewall/