Re: Incomplete OpenPKG reference in apache_log_injection.nasl

Pavel Kankovsky wrote:

>Perhaps they add an extra suffix to a URL when they publish advisories 
>on their web? Shame on them...if they really do that.
>
>  
>
That's precisely what they do. The only way to determine the exact URL 
for an advisory is to search through an index page, looking for a 
reference matching the advisory key. Turns out, they're not the only 
ones doing this; SuSE has an even wonkier advisory system on their web site.

And since the validity of such package-specific references are rather 
questionable, I'd have to say I agree that Nessus should only store the 
key itself.

One can only hope the vendors realize that it's in their own best 
interest to provide a uniform way to reference their security advisories. :)

-- 
Jan Fredrik Leversund <[email protected]>
Phalanx Security Services <URL:http://www.phalanx.no/>

_______________________________________________
Nessus-devel mailing list
[email protected]
http://mail.nessus.org/mailman/listinfo/nessus-devel