Mailing List Archive

Hello Amit,


On Aug 27, 2008, at 12:09 PM, Lad, Amit wrote:
>
>
> At this point I was totally confused, because it looks like Nessus
> technically is correct. So then I run 2 other tools (GFI Languard
> and Shavlik NetChk) against the same server and they both tell me
> the server does not require that patch. So now I have a 3 against 1
> situations, but in all aspects looking at just the file version,
> which shows the updated version should tell me the real truth.

I believe that the tools you use all use the same backend for patch
management (a Microsoft-provided XML file), meaning that they will all
be right at the same time, or wrong at the same time.

If the DLL installed on the remote hosts has the old version set, then
it means the patch has not been fully installed. Try to manually
(re)install it on one of the systems and see if that solves the problem.


Thanks,


-- Renaud

Any ideas? Anyone?



Amit Lad
Information Security Engineer
-------------------------
Ciena Corporation | Office 410.694.5998 | alad@ciena.com
<http://www.ciena.com/>





From: nessus-bounces@list.nessus.org
[mailto:nessus-bounces@list.nessus.org] On Behalf Of Lad, Amit
Sent: Wednesday, August 27, 2008 12:09 PM
To: nessus@list.nessus.org
Subject: Nessus Accuracy: 3 against 1?



Hello All,



I had a question in regards to the validity of the level
of reporting from running a scan using Nessus. We run daily scans
against our Windows Servers for missing critical and important Windows
patches. We have come across some discrepancy between our WSUS server
which deploys the patches and also has reporting and status of systems
patch level. So after digging deeper and deeper trying to find where
the miscommunication was I ran across what I think are consistent false
positives. Out of 400 servers, WSUS says 72 systems are not fully
patched. According to our Nessus scans, we have 191 non-compliant
servers. Which then starts the discussion why are the numbers so
different. So I started with a common update which Nessus says is
missing on a good amount of servers, MS06-025. The latest patch release
for that update was for June 2006.



According to Nessus:



- C:\WINDOWS\system32\Rasmans.dll has not been patched
Remote version : 5.2.3790.2697
Should be : 5.2.3790.2731



According to WSUS, the patch is not required. When I check the version
of the file on the server, it is indeed the old version. According to
the Microsoft Bulletin Release notes on Microsoft's website, the latest
version is indeed 5.2.3790.2731, with a June 2006 file date.



At this point I was totally confused, because it looks like Nessus
technically is correct. So then I run 2 other tools (GFI Languard and
Shavlik NetChk) against the same server and they both tell me the server
does not require that patch. So now I have a 3 against 1 situations,
but in all aspects looking at just the file version, which shows the
updated version should tell me the real truth.



Any ideas how to better resolve these discrepancies? We are in a
situation that we need to ramp up our patching efforts to get in
compliance and don't want to be hammered by other folks saying that our
results are false.



Thanks.

Amit Lad
Information Security Engineer
-------------------------
Ciena Corporation | Office 410.694.5998 | alad@ciena.com
<http://www.ciena.com/>

>
> According to WSUS, the patch is not required. When I check the version
> of the file on the server, it is indeed the old version. According to
> the Microsoft Bulletin Release notes on Microsoft's website, the latest
> version is indeed 5.2.3790.2731, with a June 2006 file date.
>
>
>
> At this point I was totally confused, because it looks like Nessus
> technically is correct. So then I run 2 other tools (GFI Languard and
> Shavlik NetChk) against the same server and they both tell me the server
> does not require that patch. So now I have a 3 against 1 situations,
> but in all aspects looking at just the file version, which shows the
> updated version should tell me the real truth.
>
>
>
> Any ideas how to better resolve these discrepancies? We are in a
> situation that we need to ramp up our patching efforts to get in
> compliance and don't want to be hammered by other folks saying that our
> results are false.

Hi Amit,

Tenable attempts to write as much of their Microsoft patch auditing
for Nessus to work off of file analysis than looking into the registry.
I'm not 100% sure how NetChk, WSUS or GFI performs these tests, but
it would be interesting to call their support groups for more information
or perform their tests again with access to the registry disabled. I'm
not a GFI user, but reading some of their support portal posts, it looks
like it only performs checks by looking at the registry which is not
as accurate as looking at the file.


Politically, if you manually inspected the file and it agrees with Nessus
I hope you'd conclude Nessus was correct and the other scanners were not
as accurate.

Ron Gula
Tenable Network Security

_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus