v0.4.0

[kotakanbe]

v0.4.0

We are pleased to announce the new Version, v0.4.0.
This version is not backward compatible.
But many new functions have been added.

How to install newly

• https://github.com/future-architect/vuls#tutorial-local-scan-mode

How to update to the latest verison

• https://github.com/future-architect/vuls#how-to-update-to-the-latest-version

Fast nosudo scan mode and Deep scan mode

Fast nosudo scan mode (Default)

• This mode scans

  • Ultra high speed
  • Without root privilege
  • Not consume so much resources on the servers to be scanned.
  • Scanning is possible in an environment without Internet connection
    • Some OS needs internet connection ... Amazon, FreeBSD, Raspbian

• Scan Method

  • RHEL, CentOS, Debian, Ubuntu, Oracle
    • Only collect information of the packages installed
  • Amazon
    • yum-plugin-security
  • FreeBSD
    • pkg-audit

• Report

  • Compare package version to detect CVE-IDs using local OVAL DB.
  • Use vulnerability information such as NVD, JVN, OVAL

Deep scan mode

This mode may consume resources on the server to be scanned and some commands may need root privilege. However, deep scan mode is more accurate vulnerability detection and more detailed information than fast scan mode.

• Scan Method

  • Ubuntu, Debian
    • parse changelog to detect CVE-IDs
    • need sudo(apt-get update)
  • CentOS
    • parse changelog to detect CVE-IDs
    • no sudo
  • RHEL
    • collect changelogs (no parse)
    • collect information of yum-plugin-seucrity
    • need sudo
  • Amazon Linux
    • collect changelogs (no parse)
    • collect information of yum-plugin-seucrity
    • no sudo

• Report

  • Compare package version to detect CVE-IDs using local OVAL DB.
  • Use vulnerability information such as NVD, JVN, OVAL

Improvement of vulnerabilities detection accuracy

• OVAL Support (CentOS, RHEL, Debian, Ubuntu, OracleLinux)
  • https://github.com/kotakanbe/goval-dictionary
• Use vulnerability information of OVAL when reporting.
• Use version comparison when parsing change log (CentOS, Ubuntu, Debian)

Detect the vulnerability that is not yet fixed

• CentOS
  • There are many packages that has been fixed in RedHat, but not been fixed in CentOS.
• Ubuntu, Debian
  • OVAL has this information

Notify Reboot Required

Vuls warns when the scan target server was updated the kernel etc. but not restarting it.

Change the structure of models

The structure of the model has changed.
This version is not backward compatible.

Obtain changelog

• Use yum changelog in yum-utils instead of yum update --changelog in yum-plugin-changelog to fetch changelogs without root privilege.
  • a0bafbd
• Use version comparison logic when parsing change log (Ubuntu, Debian)
  • c9cab1b

Display the information of yum plugin-security on TUI

• for RHEL, Amazon, Oracle
• Changelogs will be fetched with --deep flag of scan subcommand.
  

[kotakanbe]

CentOS 7

• v0.3.0

 One Line Summary
================
cent7idcf       centos7.2.1511  169 CVEs        223 updatable packages

• v0.4.0 fast scan mode

One Line Summary
================
cent7idcf       Total: 364 (High:142 Medium:190 Low:32 ?:0)     223 updatable packages

• v0.4.0 deep scan mode

One Line Summary
================
cent7idcf       Total: 389 (High:147 Medium:210 Low:32 ?:0)     223 updatable packages