So the final verdict RE Andrew Court's original post is this: (1) If you're running a version of Windows that records hotfixes in the registry, and you trust the information in the registry, you can use the Nessus KB items set by Plugin 13855 to get information about installed hotfixes (e.g., using the custom plugin I posted for him).
(2) If you're running a version of Windows that does not consistently record hotfixes in the registry (like Vista), or you don't trust the information in the registry, you cannot use Nessus KB information to generate a list of installed hotfixes BECAUSE the smb_nt_msXX-XXX.nasl plugins only report NEGATIVE results and do not store any results (negative or positive) in the KB. It would be useful for the smb_nt_msXX-XXX.nasl scripts to store information in the KB, but there'd probably be a trade-off in performance. Perhaps this can be tied to the verbosity level set in the nessusrc file? John Scherff 24 Hour Fitness -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Renaud Deraison Sent: Friday, November 02, 2007 8:03 AM To: Nessus List Subject: Re: Plugin 13855 - installed hotfixes On Nov 2, 2007, at 10:50 AM, Pavithra H wrote: > Hi Renaud, > Thanks for the info. > > I have a quick query for you! What was basic idea to rely on registry > entries to check for the hotfix installation? Checking the registry was faster and easier for us given the SMB implementation we had at the time. > As you said, nowadays it is cumbersome to rely on registries to > confirm patch installation. Does checking dll file versions will be a > better method to overcome this issue? Yes, looking at the DLL is definitely more reliable and that's what we intend to stick to. -- Renaud _______________________________________________ Nessus mailing list [email protected] http://mail.nessus.org/mailman/listinfo/nessus _______________________________________________ Nessus mailing list [email protected] http://mail.nessus.org/mailman/listinfo/nessus
