Hi folks,
I've had some problems with the final Nessus (latest 2.4) report
showing no MS hotfixes installed where we have absolute certainty of there
installation.
The knowledgebase does show all the Hotfixes detected in
SMB/Registry/HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/HotFix/
A bit of detective work lead me to a subroutine in smb_hotfixes.inc
called hotfix_missing which reads the KB and parses the hotfix entries to
decide whether they exist or not.
The problem seems to be with the line
if (
ereg(pattern:"SMB/Registry/HKLM/SOFTWARE/Microsoft/(Updates|/Windows
NT/CurrentVersion/HotFix)/.*/(KB|Q)" + name, string:key) )
trial and error lead me to change it to
if ( ereg(pattern:"SMB/Registry/HKLM/SOFTWARE/Microsoft/Windows
NT/CurrentVersion/HotFix/(KB|Q)" + name, string:key) )
Removing the OR for the Updates path and the regex .* seems to have
resolved the problem for the CurrentVersion/HotFix keys.
There are no entries for SMB/Registry/HKLM/Software/Microsoft/Updates
being entered into the KB (although the entries exist in the registry - I'm
sure this is down to how smb_hotfixes.nasl enters the data into the KB but
I've not fully understood the routine flow yet) so removing this pattern
match isn't loosing me information. Also some keys stored under updates/DataAccess and Active Setup/Installed Components are being
missed and not appearing in the KB.
The final report now no longer has the hotfixes found and stored in
SMB/Registry/HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/HotFix/ reported as missing.
It's very odd that this should occur only to me. I find myself wondering if it has to do with the platform I'm running Nessus from - Novell Desktop Linux 9 (basically Suse 9.2 with Novells branding) as I don't recall ever having this issue when I've used Nessus in the past.
Regards
showing no MS hotfixes installed where we have absolute certainty of there
installation.
The knowledgebase does show all the Hotfixes detected in
SMB/Registry/HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/HotFix/
A bit of detective work lead me to a subroutine in smb_hotfixes.inc
called hotfix_missing which reads the KB and parses the hotfix entries to
decide whether they exist or not.
The problem seems to be with the line
if (
ereg(pattern:"SMB/Registry/HKLM/SOFTWARE/Microsoft/(Updates|/Windows
NT/CurrentVersion/HotFix)/.*/(KB|Q)" + name, string:key) )
trial and error lead me to change it to
if ( ereg(pattern:"SMB/Registry/HKLM/SOFTWARE/Microsoft/Windows
NT/CurrentVersion/HotFix/(KB|Q)" + name, string:key) )
Removing the OR for the Updates path and the regex .* seems to have
resolved the problem for the CurrentVersion/HotFix keys.
There are no entries for SMB/Registry/HKLM/Software/Microsoft/Updates
being entered into the KB (although the entries exist in the registry - I'm
sure this is down to how smb_hotfixes.nasl enters the data into the KB but
I've not fully understood the routine flow yet) so removing this pattern
match isn't loosing me information. Also some keys stored under updates/DataAccess and Active Setup/Installed Components are being
missed and not appearing in the KB.
The final report now no longer has the hotfixes found and stored in
SMB/Registry/HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/HotFix/ reported as missing.
It's very odd that this should occur only to me. I find myself wondering if it has to do with the platform I'm running Nessus from - Novell Desktop Linux 9 (basically Suse 9.2 with Novells branding) as I don't recall ever having this issue when I've used Nessus in the past.
Regards
Andy
Send instant messages to your online friends http://uk.messenger.yahoo.com
_______________________________________________ Nessus mailing list [email protected] http://mail.nessus.org/mailman/listinfo/nessus
