-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Nessus 1.2.6 NASL scripts audit I have been working on for the last month+ is completed.
Here are a few stats some of you may want. 1) 1107 NASL Scripts for Nessus 1.2.6 2) 396 NASL Scripts with CVE 3) 359 NASL Scripts with CAN 4) 697 NASL Scripts with BugtraqID 5) 30 NASL scripts cover multiple CVE/CAN's 6) Of the 697 NASL Scripts with BugtraqID's, 339 scripts have an associated CVE's 7) Of the 697 NASL Scripts with BugtraqID's, 237 scripts have an associated CAN's 8) Currently there are a total of 3166 CANs (Not all are remote exploits!!) 9) Currently there are a total of 2223 CVEs (Not all are remote exploits!!) I have updated about 200 scripts/plugins with BugtraqIDs, CVEs, CANs, and/or source URL links. A few other minor problems were also fixed. The changes were all submitted to Renaud. Currently, as of today, Monday January 13th, 2003 all NASL scripts that require BugtraqIDs, CVEs, CANs are updated. Those that do not have BugtraqIDs, CVEs, or CANs fall into 4 categories: 1) There was never a BugtraqID, CVE, nor CAN ever issued for this problem. These type of scripts had or now has source URL links provided. For non-config scripts I submitted this information to SecurityFocus and in most cases they have already updated their system. 2) It is a configuration problem. Most of the time (like a default password, SMTP mail relay, etc.) BugtraqIDs, CVEs, CANs are not issued for configuration problems. There are source URL links provided if any could be located. 3) It was a detect script. Scripts that merely detect the presence of a server/service do not have associated vulnerabilities. 4) Problem. If I was unable to locate source information or there was another deficiency I have noted a problem. Currently this is ~3% of all scripts. Since this was an audit, a "hands off code" approach was used. The noted problems will be worked on. Hope these contributions help out the Nessus community. We will be making a LOT more. Take care Erik ********************* Erik Anderson Carmichael Security Work: [EMAIL PROTECTED] W/H/O: [EMAIL PROTECTED] -----BEGIN PGP SIGNATURE----- Version: PGP Personal Security 7.0.3 iQA/AwUBPiMv7GBNrGASwj07EQKEWQCgs3LpkYy17a2GnO7r1F1V+BDPfHMAoJVY 29+uMlvPCeegh1S7fHLRDyRp =5l1e -----END PGP SIGNATURE----- - [EMAIL PROTECTED]: general discussions about Nessus. * To unsubscribe, send a mail to [EMAIL PROTECTED] with "unsubscribe nessus" in the body.
