How to remediate – IBM Aspera Faspex Web Detection

1. Introduction

IBM Aspera Faspex is a centralized file transfer web application detected on your systems. It allows users to securely share and transfer large files, but its presence introduces potential risks if not properly managed. A successful exploit could lead to unauthorized access to sensitive data or disruption of service. Confidentiality, integrity, and availability may be impacted.

2. Technical Explanation

The vulnerability lies in the detection of IBM Aspera Faspex on a remote host. While not an exploitable flaw *in* Faspex itself, its presence indicates a potential attack surface or unauthorized software installation. Attackers often target file transfer applications to gain access to sensitive data. Exploitation would involve identifying and exploiting vulnerabilities within the Faspex application itself, which are outside the scope of this detection.

• Root cause: The presence of IBM Aspera Faspex on a system that may not require it or have appropriate security controls in place.
• Exploit mechanism: An attacker would identify and exploit vulnerabilities within the installed Faspex application, potentially gaining access to files transferred through it.
• Scope: Systems running IBM Aspera Faspex web application.

3. Detection and Assessment

Confirming the presence of Faspex helps assess your environment’s security posture. Start with a quick check for running processes, then use more thorough methods like port scanning.

• Quick checks: Use the `ps` command to look for Aspera-related processes: ps -ef | grep aspera
• Scanning: Nessus plugin ID 138497 can detect IBM Aspera Faspex installations. This is an example only, and may require updates.
• Logs and evidence: Check system logs for installation events related to IBM Aspera Faspex. Look for entries in `/var/log/syslog` or similar depending on the OS.

ps -ef | grep aspera

4. Solution / Remediation Steps

The primary solution is to assess whether IBM Aspera Faspex is required and, if not, remove it. If required, ensure it’s properly secured.

4.1 Preparation

• Services: Stop the Aspera Faspex service if removing it.
• Roll back plan: Re-install from known good media if removal causes issues.

4.2 Implementation

1. Step 1: Determine if IBM Aspera Faspex is required for business operations.
2. Step 2: If not required, uninstall the application using the appropriate package manager (e.g., `apt remove aspera-faspex` on Debian/Ubuntu).
3. Step 3: Verify removal by checking for remaining files and processes.
4. Step 4: If required, ensure Faspex is patched to the latest version and configured securely according to IBM’s documentation.

4.3 Config or Code Example

This vulnerability does not involve a specific configuration change but highlights the importance of secure software installation practices.

Before

IBM Aspera Faspex installed without security review.

After

IBM Aspera Faspex either removed or installed with latest patches and secure configuration.

4.4 Security Practices Relevant to This Vulnerability

• Least privilege: Limit user access to only the necessary files and directories within the Faspex application.
• Asset inventory: Maintain an accurate list of all software installed on your systems.

5. Verification / Validation

• Post-fix check: Run ps -ef | grep aspera and verify no Aspera processes are running if removed.
• Re-test: Re-run the initial detection methods (e.g., Nessus scan) to confirm Faspex is not detected.
• Smoke test: If Faspex is required, attempt a file transfer to ensure functionality remains intact.

ps -ef | grep aspera

6. Preventive Measures and Monitoring

• Baselines: Update your security baseline to include approved software lists and restrictions on unauthorized installations.
• Pipelines: Implement application whitelisting or blacklisting in your deployment pipelines.

7. Risks, Side Effects, and Roll Back

• Risk or side effect 1: Removing Faspex may disrupt file transfer workflows if it’s a critical business application.
• Roll back: Re-install IBM Aspera Faspex from known good media if removal causes issues.

8. References and Resources

• Vendor advisory or bulletin: https://www.ibm.com/products/aspera