Mailing List Archive: Improving local checks

Improving local checks

Mar 27, 2006, 5:47 AM

Post #1 of 4 (1807 views)

Hi,

I've just run Nessus and Security Expressions against a bunch of Windows machines and done some analysis on the results. I was only interested in the Windows local checks. On the whole, Nessus had better coverage, e.g. finding Flash Player flaws. However, SE wins when it comes to identifying missing Windows patches.

The main reason for this is that Nessus does not understand that some patches supercede others. I think I have mentioned this here before. I have an idea for fixing this, and I'd suggest starting with the recent cumulative IE patches (MS06-004, MS05-054, MS05-052, MS05-038, MS05-025 and MS05-020). Unfortunately I don't have time to implement and test this. The plan is: make plugins dependent on any plugins that supercede them (e.g. MS05-054 becomes dependent on MS06-004). This means removing some dependencies already listed, but I don't think that will cause a problem. Make plugins set a kb value if the patch is present (e.g. SMB/Hotfix/MS06-004). It seems some plugins do this already, but not all of them. Finally, add to the beginning of the plugin a check to see if the superceded patch is present. If it is, set the kb value to say the current patch is present, to support chains of superceded patches.

For MS04-044, Nessus failed to report this, because it looks at "Ntkrnlmp.exe" instead of "NToskrnl.exe". The box in question is a single processor system.

Another issue appeared for MS05-044, on a W2k box with IE6, but not IE-SP1. SE doesn't report it, as the patch is marked as affecting IE-SP1 only. Nessus does report it. I'm really not sure who's right here.

Also, local checks failed for two systems, without any apparent reason. I know the credentials are correct, and SE worked correctly. Unfortunately I didn't notice the failure until my testing window had passed.

Anyway, I hope sharing these results it useful to you.

Best wishes,

Paul

--
Paul Johnston
Technical Specialist Support Services
Group Information and IT Risk
HBOS Plc

PAJohnston@HBOSplc.com
Desk: 0113-235-3071 (7581-53071)
Mobile: 07766-740756

--

------------------------------------------------------------------------------
HBOS plc, Registered in Scotland No. SC218813. Registered Office: The Mound, Edinburgh EH1 1YZ. HBOS plc is a holding company, subsidiaries of which are authorised and regulated by the Financial Services Authority.
==============================================================================

_______________________________________________
Plugins-writers mailing list
Plugins-writers@list.nessus.org
http://mail.nessus.org/mailman/listinfo/plugins-writers

Re: Improving local checks [ In reply to ]

deraison at nessus

Mar 27, 2006, 6:26 AM

Post #2 of 4 (1700 views)

Permalink

Hi,

On Mar 27, 2006, at 8:47 AM, PaJohnston@HBOSplc.com wrote:

>
>
> The main reason for this is that Nessus does not understand that
> some patches supercede others.

Actually, Nessus does understand patches being superceded and has
provisions for that. However, in the case of the advisories you're
pointing out, this provision was not done -- it's now fixed, thanks.

It's also worth noting that this problem would not happen if you had
given Nessus credentials to connect and read to C$ (ie: administrator).

>
> For MS04-044, Nessus failed to report this, because it looks at
> "Ntkrnlmp.exe" instead of "NToskrnl.exe". The box in question is a
> single processor system.

Thanks, this is fixed as well. However note that this check was only
used for NT4, which is now unsupported by Microsoft. There are many
unpatched flaws in this version.

>
> Another issue appeared for MS05-044, on a W2k box with IE6, but not
> IE-SP1. SE doesn't report it, as the patch is marked as affecting
> IE-SP1 only. Nessus does report it. I'm really not sure who's right
> here.

We will investigate this. Once again, the best way to be sure is to
use admin credentials which can then get the exact version of the
affected DLL (instead of relying on the registry).

>
> Also, local checks failed for two systems, without any apparent
> reason. I know the credentials are correct, and SE worked
> correctly. Unfortunately I didn't notice the failure until my
> testing window had passed.

Please send us a full pcap capture of the scan of these hosts.

Thanks,

-- Renaud
_______________________________________________
Plugins-writers mailing list
Plugins-writers@list.nessus.org
http://mail.nessus.org/mailman/listinfo/plugins-writers

RE: Re: Improving local checks [ In reply to ]

PaJohnston at HBOSplc

Mar 27, 2006, 8:09 AM

Post #3 of 4 (1710 views)

Permalink

Hi,

Thanks for the quick response. Actually, I was using administrator credentials. I wonder if something else has gone wrong during the scan? When you say Nessus does understand patches being superceded, is this only when doing file version checks?

Thanks for looking into the other issues. I'm afraid I didn't trace the scans that failed, and now I am unable to touch the systems in question. If this happens again I will do that.

All the best,

Paul

--
Paul Johnston
Technical Specialist Support Services
Group Information and IT Risk
HBOS Plc

PAJohnston@HBOSplc.com
Desk: 0113-235-3071 (7581-53071)
Mobile: 07766-740756

-----Original Message-----
From: plugins-writers-bounces@list.nessus.org
[mailto:plugins-writers-bounces@list.nessus.org]On Behalf Of Renaud
Deraison
Sent: 27 March 2006 15:27
To: Johnston, Paul (Group Information & IT Risk); Nessus Plugin Writers
Mailing List
Subject: [Plugins-writers] Re: Improving local checks

Hi,

On Mar 27, 2006, at 8:47 AM, PaJohnston@HBOSplc.com wrote:

>
>
> The main reason for this is that Nessus does not understand that
> some patches supercede others.

Actually, Nessus does understand patches being superceded and has
provisions for that. However, in the case of the advisories you're
pointing out, this provision was not done -- it's now fixed, thanks.

It's also worth noting that this problem would not happen if you had
given Nessus credentials to connect and read to C$ (ie: administrator).

>
> For MS04-044, Nessus failed to report this, because it looks at
> "Ntkrnlmp.exe" instead of "NToskrnl.exe". The box in question is a
> single processor system.

Thanks, this is fixed as well. However note that this check was only
used for NT4, which is now unsupported by Microsoft. There are many
unpatched flaws in this version.

>
> Another issue appeared for MS05-044, on a W2k box with IE6, but not
> IE-SP1. SE doesn't report it, as the patch is marked as affecting
> IE-SP1 only. Nessus does report it. I'm really not sure who's right
> here.

We will investigate this. Once again, the best way to be sure is to
use admin credentials which can then get the exact version of the
affected DLL (instead of relying on the registry).

>
> Also, local checks failed for two systems, without any apparent
> reason. I know the credentials are correct, and SE worked
> correctly. Unfortunately I didn't notice the failure until my
> testing window had passed.

Please send us a full pcap capture of the scan of these hosts.

Thanks,

-- Renaud
_______________________________________________
Plugins-writers mailing list
Plugins-writers@list.nessus.org
http://mail.nessus.org/mailman/listinfo/plugins-writers

.
----------------------------------------------------------------------------------------------------------------------

HBOS plc, Registered in Scotland No. SC218813. Registered Office: The Mound, Edinburgh EH1 1YZ. HBOS plc is a holding company, subsidiaries of which are authorised and regulated by the Financial Services Authority.
==============================================================================

_______________________________________________
Plugins-writers mailing list
Plugins-writers@list.nessus.org
http://mail.nessus.org/mailman/listinfo/plugins-writers

Re: Re: Improving local checks [ In reply to ]

deraison at nessus

Mar 27, 2006, 8:15 AM

Post #4 of 4 (1713 views)

Permalink

On Mar 27, 2006, at 11:09 AM, PaJohnston@HBOSplc.com wrote:

> Hi,
>
> Thanks for the quick response. Actually, I was using administrator
> credentials. I wonder if something else has gone wrong during the
> scan?

Possibly. It would be interesting to get a pcap trace next time, to
see wether it did access C$ or not.

> When you say Nessus does understand patches being superceded, is
> this only when doing file version checks?

Both. However when doing file version checks, we don't have to go
thru the older bulletins (version N + 1 is always newer than version
N), while we have to when doing registry-based checks, and because
superceeding patches is transitive (if N supercedes M and M
supercedes O, then N supercedes O) this caused the problem you saw.
It's now fixed in CVS.

Thanks,

-- Renaud

_______________________________________________
Plugins-writers mailing list
Plugins-writers@list.nessus.org
http://mail.nessus.org/mailman/listinfo/plugins-writers