IBM Security AppScan Enterprise
Version 9.0.3.9 Readme

Overview

This document contains release notes for IBM Security AppScan Enterprise.  This product comprises several core components that can be set up together or separately across multiple machines:  the Enterprise Console is the web-based user interface; the Agents run jobs, dashboards and report packs; the analysis scanner runs the tests; and the database is where all configuration and scan results are stored.  See the Planning and Installation Guide for more detailed information, located in the same folder as this file.

These release notes provide basic installation information and document known issues that were discovered prior to release.

System Requirements

Installation Notes

Check Installing AppScan Enterprise.

The AppScan Enterprise installation includes the following download packages:

  • ASE.zip: This package contains files for the AppScan Enterprise Server. Download the file to the machine where AppScan Enterprise Server is to be installed, unzip the file, and then run the AppScanEnterpriseServerSetup_9.0.3.9.exe file.

Note: The executables for the GSC Explorer (ASE_GSCSetup.exe) and the Manual Explorer tool (ManualExplorerSetup.exe) are included in the AppScanEnterpriseServerSetup_9.0.3.9.exe and available for download through the UI, but are also provided as optional separate downloads. If you install AppScanEnterpriseServerSetup_9.0.3.9.exe, you do not need to run the executables separately.

  • ASE_DASSetup_9.0.3.9.exe: This package contains files for the Dynamic Analysis Scanner. Download the package to the machines where you plan to install AppScan scanners and run it there.

What's new in V9.0.3.9

o   Improved Action-Based Scanning: Updated Dynamic Analysis engine for greater compatibility with newer web apps, and improved coverage to reveal additional vulnerabilities

o   Windows 2016 Server support

o   Import HTTP Archive (HAR) traffic files for content scan jobs

o   To be used as login sequence data in "Login Management" screen

o   To be used as explore data in "What to Scan" page

o   Users search capability in Administration tab

o   OWASP Top 10 2017 Report in scan view

o   New ADAC capabilities:

o   Greatly Improved Login Management Configuration: Login Management includes many improvements to help you configure and manage how AppScan logs in to your application, and maintains sessions

o   New Action-Based Explore Options give you greater control, and the Action-Based tab includes new settings to help achieve more efficient Action-Based exploring

o   Communication and Proxy settings now let you:

o   Configure local proxy settings

o   Configure the local proxy with the same settings as the ASE Agent

o   Improved Chrome-based embedded browser provides greater compatibility with newer web apps

o   APIs for DevOps

o   Enhanced WebHook capability to post job status to endpoint URL

o   Enhanced REST API to support exclusions with exceptions for content scan jobs

o   New REST API for uploading a template file

o   New REST API for creating a job using a template file

o   Updated REST API to generate a report for a scan with no issues

o   Script to delete old and unused issue records included in downloads folder

o   Enhanced scanners in monitor view to compute CVSS for issues imported from AppScan Standard

The full list is available here AppScan Enterprise 9.0.3 Fix List

For additional details on Security updates and Engine fixes visit http://www-01.ibm.com/support/docview.wss?uid=swg27047066

Upgrade notes

Upgrading from 9.0.3

Upgrading from 9.0.2

Upgrading from 9.0.1

Note: Possible naming conflicts between v9.0.1 application attribute customizations and new v9.0.2 dashboard trend charts

The Open Issues and Applications with Open Issues charts rely on a new application attribute called "Open Issues" that is defined as a formula. However, if you previously created an application attribute called "Open Issues" of any type other than formula, the upgrade does not attempt to resolve the conflict between your attribute and the one that version 9.0.2 needs for the new charts.

The new charts will not display as intended after upgrade, and you must resolve this problem manually. Rename your "Open Issues" attribute to something else if you want to preserve its values. Update all formulas where you referenced your "Open Issues" attribute to reflect the new name. Then, rerun the configuration wizard to create the "Open Issues" formula attribute that the new charts require.

Upgrading from 9.0

v9.0

v9.0.1

Result

Folder A: (Bob has an Issue Manager role)

  • Scan X
  • Scan Y

Folder B: (Mary has an Issue Manager role)

  • Scan A
  • Scan B

Application 1 is associated with these scan jobs:

  • Scan X
  • Scan B

Mary now has basic access permissions to Scan B so that she can continue to do her job but she also has access to Scan X, which she didn't have in v9.0.

o   To restrict a user's permissions to managing issues on specific applications, remove them from the Basic Access on the applications they are not allowed to access. In the example above, remove Mary's Basic Access permissions on Scan X. To find the application that contains Scan X, go to the Scans view and flatten the hierarchy to show only jobs. Find Scan X and click the link for the application name it is associated with. On the Application tab, click View details and in the Users section of the dialog, remove Mary's Basic Access permissions.

Upgrading from 8.8

Upgrading from 8.7

Upgrading from 8.6 to 8.7

The upgrade process to 8.7 includes a one-time database optimization step that requires additional time and could extend the overall upgrade process.

 

Deprecated Features

Deprecated Features are listed here.

Known Issues and Workarounds

  • When you record a login sequence in AppScan Dynamic Analysis client using Login Management, and then move to the Review & Validate tab, if Request-Based is the selected Login Playback Method, you may be unable to change it to Action-Based. Workaround: Close the Scan Configuration dialog box and reopen it.
  • Documentation update for this release is done in English only. Translation update into additional languages is deferred to a subsequent release.
  • It is required to install SQL Native Client version (SQLNCLI11) if the config wizard fails to connect to SQL Server database after installing MDAC 2.7 or higher.
  • Knowledge Center (KC) is updated with all the changes but product inline help is not updated in this release.
  • If the extended log file size is large ( beyond 2GB ), sometimes the download log file operation from Scan tab summary report might result in a 0KB zip file. In such instances, user will have to copy the file from the Logs directory in the AppScan Enterprise Agent server.
  • Removal of OWASP 2013 and support for OWASP 2017 Report: All report pack and report pack templates created prior to 9.0.3.9 will have report OWASP 2013 itself. If required, this will have to be manually removed and OWASP 2017 report should be added by the user.
  • When a template is uploaded into ASE via REST API, the edit page of that template throws an exception on the page "An unknown error has occurred. Contact your Product Administrator. " But it does not affect any functionality of editing the template or creating and running a Job out of it.
  • As an administrator, if you edit an existing scan in the Dynamic Analysis Configuration Client, and click "Update Job" from any page in the 'Additional' scan property pages, you will get an "Update all required fields" error message. Click "Update Job" again to resolve the message and exit the Client.
  • When you edit a scan in the Dynamic Analysis Configuration Client, make sure that the scan you want to edit is not running in AppScan Enterprise; otherwise it might suspend when you update the scan. Alternatively, on the Job Properties page of the Client, clear the 'Run job as soon as possible' check box and then click 'Update Job'.
  • The summary charts in the Dashboard tab do not render properly in Internet Explorer 8.0. Use Microsoft Silverlight with Internet Explorer 8.0. The charts will load, but interaction will not work. Consider upgrading your browser to IE 11 or FireFox 31.
  • To access the new interactive REST API framework in 9.0.1, the AppScan Enterprise instance name must be called 'ase' (for example, https://<localhost>:9443/ase/api/pages/apidocs.html).
  • Use Microsoft Silverlight with Internet Explorer 8.0 to properly render Dojo functionality.
  • When a scan job only has a recorded login (no Manual Explore or Starting URLs), the scan will not crawl below that page. Add at least one URL to the Manual Explore or Starting URL of the What to Scan page.
  • If you upgrade a database from pre-8.8, and then click any existing job, the scan log will be empty. Rerun your jobs to generate a new scan log.
  • When editing the Edit Application Profile Template page in IE 8/9, changes are not saved. Navigate away from the field you are editing and then back to it. Save your changes. Alternatively, upgrade your browser to IE10 or Firefox 24.
  • JavaScript Analyzer (JSA) is turned off by default on scans, including upgraded scans. You can enable JSA on the Security page of your content scan job.
  • For performance improvements, upon upgrade to 8.6.0.2, security tests are no longer sent against non-applicable content such as image files, documents, media files, etc. Further details are available at http://www.ibm.com/support/docview.wss?uid=swg21618288.
  • Since AppScan Enterprise Server sends security tests that some firewall products could flag as suspicious network activity, there is a risk of performance degradation and of false negative results when the firewall is deployed between the Agents and the website being scanned.
  • When normalization rules are defined within the Job Properties, it is important to ensure that they result in a valid URL. If the user-defined normalization rules results in an empty URL string, there is a risk of the scan not ending.
  • If Issue Management has been done on the reports, the Report Pack Summary report will be out of synchronization with the report data. The Report Pack will need to be re-run to synchronize the numbers when Issue Management tasks are completed.
  • Deleted reports are not immediately removed from the dashboard. The dashboard must be re-run for the change to take effect.
  • When using Manual Explore functionality in IE it is advised to enable the Internet/Advanced Option for 'Use HTTP 1.1 through proxy connections'; otherwise connectivity issues and/or performance degradation may occur.
  • When sorting lists, the collation order may not work as expected for the following languages: Danish, Japanese, and Chinese. .NET and SQL collations are used, as are locale-specific collations, but the product does not comply with ICU.

Product Fix History

Product fixes by version are listed here.

Notices

� � Copyright IBM Corporation 2000, 2017. � Copyright HCL Limited 2018. All rights reserved.

U.S. Government Users Restricted Rights - Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

This information was developed for products and services offered in the U.S.A.

IBM may not offer the products, services, or features discussed in this documentation in other countries and regions. Consult your local IBM representative for information on the products and services currently available in your area. Any reference to an IBM product, program, or service is not intended to state or imply that only that IBM product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any IBM intellectual property right may be used instead. However, it is the user's responsibility to evaluate and verify the operation of any non-IBM product, program, or service.

IBM may have patents or pending patent applications covering subject matter described in this document. The furnishing of this document does not grant you any license to these patents. You can send license inquiries, in writing, to:

IBM Director of Licensing
IBM Corporation
North Castle Drive
Armonk, NY 10504-1785
U.S.A.

For license inquiries regarding double-byte (DBCS) information, contact the IBM Intellectual Property Department in your country or region, or send inquiries, in writing, to:

IBM World Trade Asia Corporation
Licensing
2-31 Roppongi 3-chome, Minato-ku
Tokyo 106-0032, Japan

The following paragraph does not apply to the United Kingdom or any other country or region where such provisions are inconsistent with local law: INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you.

This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice.

Any references in this information to non-IBM Web sites are provided for convenience only and do not in any manner serve as an endorsement of those Web sites. The materials at those Web sites are not part of the materials for this IBM product and use of those Web sites is at your own risk.

IBM may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you.

Licensees of this program who wish to have information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged, should contact:

Intellectual Property Dept. for Security Software
IBM Corporation
20 Maguire Road
Lexington, Massachusetts 02421-3112
U.S.A.

Such information may be available, subject to appropriate terms and conditions, including in some cases, payment of a fee.

The licensed program described in this document and all licensed material available for it are provided by IBM under terms of the IBM Customer Agreement, IBM International Program License Agreement or any equivalent agreement between us.

Any performance data contained herein was determined in a controlled environment. Therefore, the results obtained in other operating environments may vary significantly. Some measurements may have been made on development-level systems and there is no guarantee that these measurements will be the same on generally available systems. Furthermore, some measurements may have been estimated through extrapolation. Actual results may vary. Users of this document should verify the applicable data for their specific environment.

All statements regarding IBM's future direction or intent are subject to change or withdrawal without notice, and represent goals and objectives only.

This information contains examples of data and reports used in daily business operations. To illustrate them as completely as possible, the examples include the names of individuals, companies, brands, and products. All of these names are fictitious and any similarity to the names and addresses used by an actual business enterprise is entirely coincidental.

If you are viewing this information softcopy, the photographs and color illustrations may not appear.

Trademarks and service marks

IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corporation in the United States, other countries and regions, or both. These and other IBM trademarked terms are marked on their first occurrence in this information with the appropriate symbol (� or �), indicating US registered or common law trademarks owned by IBM at the time this information was published. Such trademarks may also be registered or common law trademarks in other countries and regions. A current list of IBM trademarks is available on the Web at www.ibm.com/legal/copytrade.html.