New Nessus Report Consolidates Missing Patches
Ensuring that patches are applied to systems is a complex problem. Pinpointing those patches that must be applied to become current requires careful analysis. The new Nessus consolidated “Patch Report” plugin identifies which patches to apply to protect your systems.
The Challenges of Patching
Regardless of platform, there are a plethora of patches to be applied. I tend to break them up into three general categories:
- Operating System (OS) Patches - These are patches made available by your OS vendor. In the case of Microsoft Windows and Apple OS X, it's fairly straight forward as patches are released that apply primarily to the software which comes with the OS. Microsoft also provides regular patch updates for Microsoft Office as well.
- 3rd-party Applications - Software installed by the user (outside of any package management system) is classified as third-party. Popular software, such as web browsers and related add-ons (Oracle Java, Adobe Flash), plague this category, making it challenging to manage and keep up-to-date.
- Packages Offered by the Distribution - In the case of Linux/UNIX, the OS patches are extended by the package management system and offer patches for your kernel, core software, and other software installed by the distribution. This software sits somewhere between the OS and third-party software.
Systems will often become out-of-date rather quickly, especially those that may have fallen outside your patch management strategy. When these hosts are scanned by Nessus, sometimes more than 100 different missing patches will be reported. For example, you can get a complete report of missing Microsoft patches for each host:
Consolidated OS Patches
Nessus now helps with patch consolidation. The new Nessus “Patch Report” plugin (ID #66334) will display a list of consolidated patches, only showing the patches that need to be applied and omitting superseded patches:
The new plugin can also exclude superseded patches from the results. The following option allows the user to control this behavior:
Consolidated Third-party Application Patches
The "Patch Report" will also summarize patches for third-party software. For example, let's say that you've scanned a target that's running an outdated version of Adobe Flash. The missing patches are represented as follows:
In order to keep this system up-to-date, not necessarily all of the patches listed above need be applied. It's more likely that applying one Adobe Flash update will install all of the missing updates. The Nessus "Patch Report" plugin now reports this information and presents a consolidated list of patches that must be applied:
Platform Support
The new "Patch Report" plugin supports all major platforms (Windows, OS X, UNIX, and Linux) and includes both OS and third-party software patches. Linux local patch checking is still in the works; however, if Nessus finds vulnerable software remotely (without credentials), a consolidated patch report is still issued. For example, Nessus found two vulnerabilities (and one informational level result) in the running Apache web server:
The solution for the "Apache Byte Range DoS" vulnerability is to upgrade to Apache version 2.2.21 or later. The solution for the "httpOnly Cookie Information Disclosure" vulnerability is to upgrade to 2.2.22 or later, resulting in the following patch report:
Conclusion
Systems administrators are already overwhelmed with their daily tasks. When security assessments are performed, it can be perceived as added work to sift through vulnerabilities and figure out what needs to be done to remediate the issues. The new Nessus "Patch Report" plugin will foster better communication and teamwork between the security and systems administration groups, allowing Nessus to make an actionable report.
Resources
- If a Security Control Falls in the Forest... - "Many guidelines and compliance standards state that in order to be "secure" or "compliant," all of your systems must be patched. Turns out that this is easier said than done. Just when you believe your systems to be patched, something fails and patches seemingly disappear."
Related Articles
Study: Tenable Offers Fastest, Broadest Coverage of CISA's KEV Catalog
October 23, 2023Tenable ranked first in multiple vulnerability management categories, including the most comprehensive coverage and quickest detection of CISA's Known Exploited Vulnerabilities, according to a Miercom report commissioned by Tenable.
Tuning Network Assessments for Performance and Resource Usage
September 13, 2022Using the correct tool for the job and optimizing scanner placement will have a large impact on scan efficiency with Nessus, Tenable.io and Tenable.sc.
Terrascan Joins the Nessus Community, Enabling Nessus To Validate Modern Cloud Infrastructures
May 17, 2022The addition of Terrascan to the Nessus family of products helps users better secure cloud native infrastructure by identifying misconfigurations, security weaknesses, and policy violations by scanning Infrastructure as Code repositories.
Cybersecurity Snapshot: Five Eyes Rank 2023’s Most Frequently Exploited CVEs, While CSA Publishes Framework for AI System Audits
November 15, 2024Check out the CVEs attackers targeted the most last year, along with mitigation tips. Plus, a new guide says AI system audits must go beyond check-box compliance. Meanwhile, a report foresees stronger AI use by defenders and hackers in 2025. And get the latest on cloud security, SMBs' MFA use and the CIS Benchmarks.
Who’s Afraid of a Toxic Cloud Trilogy?
November 14, 2024The Tenable Cloud Risk Report 2024 reveals that nearly four in 10 organizations have workloads that are publicly exposed, contain a critical vulnerability and have excessive permissions. Here’s what to watch for in your organization.
Microsoft’s November 2024 Patch Tuesday Addresses 87 CVEs (CVE-2024-43451, CVE-2024-49039)
November 12, 2024Microsoft addresses 87 CVEs and one advisory (ADV240001) in its November 2024 Patch Tuesday release, with four critical vulnerabilities and four zero-day vulnerabilities, including two that were exploited in the wild.
- Nessus
- Patch Auditing