News for hackers. Stuff that matters.

A comment on Flan Scan: Lightweight Network Vulnerability Scanner. Parent comment

Re:Flan Scan: Lightweight Network Vulnerability Scanner by justin66 on Friday November 22, 2019 @10:35AM (#21606465)
> It seems all this tool does is some kind of version matching (i.e. "a CVE has been reported for version x.y.z of software A, so a server running x.y.z is vulnerable"). This is a poor proxy for the actual existence of a vulnerability

It sounds as though it's illustrative of a problem with either the index the scanner software is referring to or the update methodology the distro relies on. Debian don't really fix the software without incrementing the version number in some fashion, do they?

[ Parent | on HN ]
Re:Flan Scan: Lightweight Network Vulnerability Scanner by zerocrates on Friday November 22, 2019 @11:08AM (#21606834)
It's pretty typical for these "backported" packages to have version numbers that only differ from the original by a suffix, and that suffix often only appears in the package manager.

For example, the Debian stable Apache package is currently version 2.4.38-3+deb10u3, but Apache will typically report something less than all that information, like just 2.4.38.

If it's really just looking at exposed version numbers, there's plenty of other problems, like servers that are configured to not expose their version numbers.

[ Parent | on HN ]