Mailing List Archive

On Wednesday 05 November 2008 16:44:04 Scott Pate wrote:
> Nessus doesn't give, and I can't find, any details as to how it came to
> this conclusion.

Did you select "silent dependencies"? If so, try without it.
If not, could you send me the KB please?

Note that you should enable all plugins for a PCI DSS scan.


_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus

I ran the test with silent dependencies disabled and there was no change
in the results.

thanks

-----Original Message-----
From: Michel Arboi [mailto:mikhail@nessus.org]
Sent: Wednesday, November 05, 2008 10:12 AM
To: nessus@list.nessus.org
Cc: Scott Pate
Subject: Re: plugin 33929

On Wednesday 05 November 2008 16:44:04 Scott Pate wrote:
> Nessus doesn't give, and I can't find, any details as to how it came
to
> this conclusion.

Did you select "silent dependencies"? If so, try without it.
If not, could you send me the KB please?

Note that you should enable all plugins for a PCI DSS scan.


_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus

On Thursday 06 November 2008 15:01:47 Scott Pate wrote:
> I ran the test with silent dependencies disabled and there was no change
> in the results.

Could you send me the report and the KB, please?
_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus

On Wednesday 05 November 2008 16:44:04 Scott Pate wrote:
> This plugin reported a web server I scanned as being vulnerable to SQL
> injection.

We identified the problem and fixed it. It will soon be in the feed.
Thanks.

Note: in your situation, the bug was triggered by optimize_tests=no. This
configuration is not recommended (and it is slower).
_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus

Well, now I'm confused. I noticed with the new NessusClient that there
was no longer an option to set 'optimize test' and I posted a question
about it. Renaud gave this response


++++++
Hi Scott,

On Jun 10, 2008, at 2:20 PM, Scott Pate wrote:


Unless I am missing something, it seems there are some options missing
from the new NessusClient

-Where is the option to enable/disable "optimize test"?


This option is not exposed any more. Given how we code plugins now,
there is no reason why you would want to use it.



-- Renaud
+++++++

Also, NessusClient has no option for 'optimize test', yet it is still in
the xml file and the default value is set to 'no'. This means I would
have to go into the xml file and change it each time I run a scan.

thx



-----Original Message-----
From: Michel Arboi [mailto:mikhail@nessus.org]
Sent: Friday, November 07, 2008 7:00 AM
To: nessus@list.nessus.org
Cc: Scott Pate
Subject: Re: plugin 33929

On Wednesday 05 November 2008 16:44:04 Scott Pate wrote:
> This plugin reported a web server I scanned as being vulnerable to SQL
> injection.

We identified the problem and fixed it. It will soon be in the feed.
Thanks.

Note: in your situation, the bug was triggered by optimize_tests=no.
This
configuration is not recommended (and it is slower).

On Friday 07 November 2008 14:20:33 you wrote:
> Also, NessusClient has no option for 'optimize test', yet it is still in
> the xml file and the default value is set to 'no'. This means I would
> have to go into the xml file and change it each time I run a scan.

Please check nessusd.conf (/opt/nessus/etc/nessus/nessusd.conf on all Unix but
FreeBSD). It probably contains optimize_tests=no; change that to yes

If there is no such line, either modify your policy in the XML file (this need
to be done once) or create a new one.

_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus

I set optimize_test=yes in the xml and that seems to have fixed the
problem

thanks

-----Original Message-----
From: Michel Arboi [mailto:mikhail@nessus.org]
Sent: Friday, November 07, 2008 8:58 AM
To: Scott Pate; nessus@list.nessus.org
Subject: Re: plugin 33929

On Friday 07 November 2008 14:20:33 you wrote:
> Also, NessusClient has no option for 'optimize test', yet it is still
in
> the xml file and the default value is set to 'no'. This means I would
> have to go into the xml file and change it each time I run a scan.

Please check nessusd.conf (/opt/nessus/etc/nessus/nessusd.conf on all
Unix but
FreeBSD). It probably contains optimize_tests=no; change that to yes

If there is no such line, either modify your policy in the XML file
(this need
to be done once) or create a new one.

_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus