Re: Re: several messages

Michel Arboi wrote:

> > You can add multiple keys for "at least version X.Y.Z is installed".
> > I.e. 1.15 would have one key for 1.14 and 1.15 (assuming both versions
> > are interesting milestones, look below).
> > Advantages:
> > - works without any new code,
> > - makes it easy to accomodate any wierd version numbering.

> I see another problem. Let's say we have scripts that test flaws in
> Apache/2.0.47 and we identify an Apache/2.0.50 on the target. So we
> set : AtLeast/Apache/2.0.48 (and maybe AtLeast/Apache/2.0.50 too)
> and our scripts use:
> script_exclude_keys("AtLeast/Apache/2.0.48");
> So far so good.
> But if there is a 2nd vulnerable Apache running on another port, we
> miss it.

> That's why I implemented optimization_level: level 2 ignores
> script_exclude_keys instructions, if you want to be sure that you do
> not forget anything.

I agree that it's possible for there to be multiple versions of the same web
server software on a system.

But I submit that the problem, therefore, is that either the kb should be providing the correct key to the correct plugin (i.e. matching to the port that the plugin is working on), or the banner collector (which is the one that would be figuring out what versions are installed) should detect that multiple web servers are installed and set or not set something differently. (for example, not set AtLeasts that don't apply to both servers.)

Thanks
_______________________________________________
Nessus-devel mailing list
[email protected]
http://mail.nessus.org/mailman/listinfo/nessus-devel