How to remediate – NetIQ Access Manager Detect

1. Introduction

NetIQ Access Manager Detect identifies a network access administration web application installed on the remote server. This is a common component in organisations managing user identities and access rights, but its presence indicates a potential attack surface. Successful exploitation could lead to unauthorised access to sensitive systems and data. The likely impact is medium confidentiality, integrity, and availability.

2. Technical Explanation

The vulnerability exists because NetIQ Access Manager is installed on the server. An attacker gaining access to this application can potentially compromise the system or use it as a stepping stone into the network. Exploitation requires local access to the server where NetIQ Access Manager is running.

• Root cause: The presence of the web application itself represents a potential entry point for attackers.
• Exploit mechanism: An attacker with local access could attempt to exploit known vulnerabilities within the NetIQ Access Manager software, or use it as part of a wider attack chain.
• Scope: This affects servers running NetIQ Access Manager. Specific versions are not detailed in this report.

3. Detection and Assessment

Confirming the presence of NetIQ Access Manager is the primary assessment step.

• Quick checks: Check for the application’s process name or associated files on the server.
• Scanning: Nessus plugin ID 16283 may identify this software. This is an example only.
• Logs and evidence: Review application logs for unusual activity, though specific event IDs are not provided.

ps -ef | grep netiq

4. Solution / Remediation Steps

The solution involves securing or removing the NetIQ Access Manager installation.

4.1 Preparation

• Consider a change window and approval process for significant configuration changes.

4.2 Implementation

1. Step 1: Review the NetIQ Access Manager documentation for security best practices.
2. Step 2: Apply any available patches or updates to the software.
3. Step 3: If the application is not required, uninstall it from the server.

4.3 Config or Code Example

This vulnerability does not involve a specific config change but highlights the importance of secure configuration.

Before

No specific insecure configuration provided. Focus on default settings review.

After

Review NetIQ Access Manager documentation for security hardening guidelines and apply them.

4.4 Security Practices Relevant to This Vulnerability

Several practices can mitigate the risk.

• Practice 1: Least privilege access to limit damage from a compromised account.
• Practice 2: Regular patch cadence to address known vulnerabilities in software like NetIQ Access Manager.

4.5 Automation (Optional)

No automation steps are provided as this depends on the specific environment.

5. Verification / Validation

Confirm that the application is patched or removed, and verify basic functionality if retained.

• Post-fix check: Run the initial detection command (ps -ef | grep netiq) to confirm the process is no longer running if uninstalled.
• Re-test: Re-run the Nessus scan to ensure the vulnerability is no longer reported.
• Smoke test: If retained, verify users can still log in and access required resources.
• Monitoring: Monitor application logs for unusual activity as an example of regression detection.

ps -ef | grep netiq

6. Preventive Measures and Monitoring

Focus on asset management and secure configuration.

• Baselines: Update security baselines to include a list of approved software, including NetIQ Access Manager.
• Pipelines: Implement vulnerability scanning in CI/CD pipelines to identify unpatched software.
• Asset and patch process: Establish a regular review cycle for installed software and apply patches promptly.

7. Risks, Side Effects, and Roll Back

Uninstalling NetIQ Access Manager may disrupt access management services.

• Risk or side effect 1: Uninstalling the application could break existing integrations. Mitigate by testing in a non-production environment first.
• Risk or side effect 2: Patching might cause temporary service interruption. Schedule during off-peak hours.
• Roll back: Restore from the pre-change snapshot if issues occur.

8. References and Resources

• Vendor advisory or bulletin: https://www.netiq.com/solutions/identity-access-management/
• NVD or CVE entry: No specific CVE is detailed in this report.
• Product or platform documentation relevant to the fix: Refer to NetIQ Access Manager official documentation for patching and configuration guides.