How to remediate – Novell iManager Detection

1. Introduction

Novell iManager Detection indicates that a network administration web application is accessible on the remote host. This tool manages Novell Open Enterprise Server environments and presents an attack surface if left exposed. Systems running Novell iManager, particularly those directly accessible from the internet, are usually affected. A successful exploit could allow attackers to gain control of the server and compromise its data, integrity, and availability.

2. Technical Explanation

Nessus identified access to the web interface of Novell iManager. This means the application is listening on a network port and responding to requests. An attacker could potentially exploit vulnerabilities within iManager to gain administrative control. There are no specific CVEs associated with simply detecting the service, but known weaknesses in older versions exist. For example, an attacker might attempt default credential attacks or leverage unpatched flaws in the web application itself.

• Root cause: The Novell iManager web interface is exposed on a network connection.
• Exploit mechanism: An attacker could attempt to access the interface using common credentials or exploit known vulnerabilities within the application. A simple attack might involve attempting login with default username and password combinations.
• Scope: This affects systems running Novell Open Enterprise Server with iManager installed, particularly versions exposed to external networks.

3. Detection and Assessment

Confirming vulnerability involves checking for the presence of the iManager web interface and its version. A quick check can be done via a browser or port scan. More thorough assessment requires examining application settings.

• Quick checks: Use a web browser to access https://:443 (or the configured iManager port). If accessible, the interface is present.
• Scanning: Nessus plugin ID 10826 can detect this issue. Other vulnerability scanners may have similar plugins.
• Logs and evidence: Check web server logs for requests to the iManager application path. Event IDs are not typically specific to this detection.

nmap -p 443 

4. Solution / Remediation Steps

The primary solution is to restrict access to the Novell iManager web interface or remove it if no longer needed. These steps aim to reduce exposure and potential attack vectors.

4.1 Preparation

• Services: No services need to be stopped for firewall rule adjustments.
• Change window: A standard change window may be required depending on internal policies. Approval from system owners might be needed.

4.2 Implementation

1. Step 1: Block external access to port 443 (or the configured iManager port) using a firewall.
2. Step 2: If iManager is not required, uninstall it from the system.
3. Step 3: Verify that internal access remains functional if needed.

4.3 Config or Code Example

Before

# Firewall rule allowing external access on port 443 (example)
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

After

# Firewall rule blocking external access on port 443 (example)
iptables -A INPUT -p tcp --dport 443 -j DROP

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this issue and similar exposures. These focus on reducing attack surface and controlling access.

• Practice 1: Least privilege – limit network access to only necessary ports and services.
• Practice 2: Network segmentation – isolate sensitive systems from external networks.

4.5 Automation (Optional)

# Example Ansible playbook to block port 443 on remote hosts
- name: Block iManager access
  hosts: all
  tasks:
    - iptables:
        chain: INPUT
        protocol: tcp
        dport: 443
        jump: DROP

5. Verification / Validation

Confirm the fix by verifying that external access to iManager is blocked and internal access remains functional if required. A service smoke test ensures core functionality isn’t impacted.

• Post-fix check: Use a web browser from an external network to attempt accessing https://:443. The connection should be refused or time out.
• Re-test: Re-run the Nessus scan (plugin ID 10826) and confirm it no longer reports the vulnerability.
• Smoke test: If iManager is used internally, verify that authorized users can still log in and perform basic administration tasks.
• Monitoring: Monitor firewall logs for blocked connections to port 443 as an example of regression detection.

nmap -p 443 

6. Preventive Measures and Monitoring

Preventive measures include updating security baselines and incorporating checks into CI/CD pipelines to avoid similar exposures. For example, regularly review firewall rules and system configurations.

• Baselines: Update a security baseline or policy to restrict unnecessary network access.
• Pipelines: Add checks in deployment pipelines to ensure only required ports are open.
• Asset and patch process: Review the asset inventory regularly for unused services like iManager.

7. Risks, Side Effects, and Roll Back

Blocking access to port 443 could disrupt legitimate users if they rely on iManager. Incorrect firewall rules can cause wider connectivity issues.

• Risk or side effect 1: Disruption of internal iManager users – ensure authorized users have alternative access methods.
• Roll back: Revert the firewall rule changes to allow external access on port 443.

8. References and Resources

• Vendor advisory or bulletin: https://www.microfocus.com/products/open-enterprise-server/features/imanager-network-administration-tool/?utm_medium=301&utm_source=novell.com