I'm fairly new to Nessus, and I was wondering if somebody could help me
clarify something.

I've understood that one of the cool things about Nessus is that it actually
checks for the vulnerabilies instead of just looking at the version.

But I ran it against one of my servers and it reported some
'vulnerabilities' that I think are false positives based on the version
reporting.

For instance:
OpenSSH - Nessus says I'm running a version older than 3.4. True, but I
contacted RedHat and they say that their version 3.1p1 includes the patches.
But if you look at the version number, then yes, it will look like it is
vulnerable.

Stronghold web server - Nessus detects mod_ssl older than 2.8.10 and OpenSSL
older than 0.9.6e. True again, but the latest version of Stronghold includes
the patches - they just don't increment the version number.

So does Nessus really check for the vulnerabilities or the version? If it
can actually check for the vulnerabilities, is there something I need to do
or something I'm not doing right? I'm confused.

Thanks for any info.

-
[EMAIL PROTECTED]: general discussions about Nessus.
* To unsubscribe, send a mail to [EMAIL PROTECTED] with
"unsubscribe nessus" in the body.

Reply via email to