Re: [expert] Security Updates - Versions DON'T MATCH CVEs

[Albert Whale]

My Apologies Vincent, I didn't mean to post in HTML, but XP Blew up last 
night on my laptop, and killed my Netscape preferences, I'm still 
recovering.  Thantks, I';ve switched to Text mode.

Vincent Danen wrote:

On Thu Sep 25, 2003 at 11:13:23PM -0400, Albert Whale wrote:

My response will be short simply due to the fact that you posted in html and
I can't quote it and can't be bothered to cut-n-paste.
My apologies.

Every Mandrake advisory includes the CVE names for the correlating problem.
Trying using the CVE search mechanism on MandrakeSecure.  That should be
adequate.  Nessus tells you CVE-bla-bla, you go to MandrakeSecure and do the
CVE search for CVE-bla-bla, and immediately you find what advisories, if any
deal with that CVE name.
 

I think that having the CVE to MDKSA posted as a Table would be more 
beneifical.  I'm sure that your developers have taken great strides to 
apply patches on the src rpms, all driven by the CVEs.  I'm only asking 
for a table depicting the CVEs, and MDKSA (with the actual RPM Name) Per OS.

And contrary to your shouting, I have nothing against Nessus... I like it.
But I'm not gonna turn around name packages
"openssh-3.6.1p2-CVE-2003-xxxx-1.1mdk" just so you can avoid using a very
simple search field on the website.
I guess my point was missed.  We don't want to perform queries.  Unless 
the PHP or HTML Page we pull up from MandrakeSecure Queries the Data to 
sort it and correlate the CVEs and the MDKSAs (and RPM names).  This is 
what the Management Teams want to see, one page (maybe more), of 
Vulnerabilities to Updates.  Thus while you're going through the chart 
of vulnerabilities, we can EASILY Correlate one page to the report.  Do 
you really want all of us querying the CVEs for each server??

Apologies if you thought that I was hollering, as I wasn't.  Just 
thinking aloud to stress a point.  We work with Mandrake and Nessus to 
make the Security Issues disappear.  Making it easier to perform our 
duties benefits all of us.

(BTW, this was implemented a *long* time ago)

 

--
Albert E. Whale, CISSP - Sr. Security, Network, and Systems Consultant
--------------------------------------------------------------------------------
http://www.abs-comptech.com & http://www.No-JunkMail.com 
ABS Computer Technology, Inc. - ESM, Computer & Networking Specialists
No-JunkMail.com - SPAM Stops Here.
Founding Board of Directors of Pittsburgh FBI - InfraGard



Want to buy your Pack or Services from MandrakeSoft? 
Go to http://www.mandrakestore.com