Hi all, > -----Original Message----- > From: [email protected] [mailto:openvas- > [email protected]] On Behalf Of Vlatko Kosturjak > Sent: Monday, March 08, 2010 4:26 PM > To: Dražen Popović > Cc: [email protected] > Subject: Re: [Openvas-plugins] MS-RPC for GSoC > > [...] > > I would also add inconsistency. There are some remote checks, but not > all. And there is no easy classification(time, platform, ...) to say > which are implemented and which are not due to different reasons > (licensing problems due to old code, some checks are harder to > implement, ...). > > Would be perfect to start a wiki page which will list vulns and status > for local and remote implementations, i.e.: > MS09-01, local implemented: name-of.nasl, remote not implemented > MS09-50, local implemented: name-of.nasl, remote implemented: name- > of.nasl > SS22-30, local implemented: name-of.nasl, remote check not possible > > Yes, I know for cve_current.txt on SVN, but the text file doesn't have > all the info needed and it is mostly visible to developers. IMHO wiki > is > much more easier to comment, put links to additional info, edit format > and get priority feedback. And it is also easier for people/users to > see that as well (so, they don't rely on something that it is not > implemented). >
Totally agree here. More systematic development of remote checks is a great idea. Also agree that wiki would be IMHO good way to go as it is much more descriptive and easier to access and edit than cve_current.txt approach. I would also like to raise a question about invasive and non-invasive (safe) remote checks. Which one of these are preferred in OpenVAS? In my opinion checks based on reading version form banner are good and safe way to check for vulnerability, but still they are not as reliable as executing the actual exploit and i.e. crash service. Maybe it makes sense to have both? I would love to hear your opinions on this... All the best, Goran Licina, dipl.ing. -- Laboratory for Systems and Signals Department of Electronic Systems and Information Processing Faculty of Electrical Engineering and Computing University of Zagreb Tel: +385 1 612 97 75 • Fax: +385 1 612 98 89 • Mob: +385 98 955 90 59 Web: http://www.lss.hr _______________________________________________ Openvas-plugins mailing list [email protected] http://lists.wald.intevation.org/mailman/listinfo/openvas-plugins
