Red Hat NETWORK 3.6 - Guia do Utilizador descarregar pdf (Página 31)

Restarting the Passive Vulnerability Scanner

Once new passive plugins or operating system fingerprints are available to the PVS, it must

be stopped and started again.

WRITING PASSIVE VULNERABILITY SCANNER PLUGINS

Plugin Keywords

There are several keywords available for writing passive vulnerability plugins for PVS. Some

of these keywords are mandatory and some are optional. The mandatory keywords are

highlighted in blue.

Name

Description

bid

Tenable assigns SecurityFocus Bugtraq IDs (BID) to PVS

plugins. This allows a user reading a report generated by the

PVS to link to more information available at

http://www.securityfocus.com/bid. Multiple Bugtraq entries can

be entered on one line separated by commas.

bmatch

This is the same as “match” but can look for any type of data.

clientissue

If a vulnerability is determined in a network client such as a

web browser or an email tool, a server “port” will be

associated with the reported vulnerability.

cve

Tenable also assigns Common Vulnerability and Exposure

(CVE) tags to each PVS plugin. This allows a user reading a

report generated by the PVS to link to more information

available at http://cve.mitre.org/. Multiple CVE entries can be

entered on one line separated by commas.

dependency

This is the opposite of “noplugin”. Instead of specifying

another plugin that has failed, this keyword specifies which

plugin has to have succeeded. This keyword specifies a PVS

ID that should exist in order for the plugin to be evaluated.

In addition, this plugin can take the form of

“dependency=ephemeral-server-port”, which means that

the server being evaluated must have an open port above

port 1024.

description

This field describes on one line the nature of the detected

vulnerability. This data is printed out by the PVS when

printing the vulnerability report. Macros are available that

allow for the printing of matched network traffic such as

banner information and are discussed in the examples below.

For line breaks, the characters “<br>” can be used to invoke

a new line.

Exploitability:

canvas

core

Displays exploitability factors for the selected vulnerability.

For example, if the vulnerability is exploitable via both Canvas

and Core and has a unique CVSS temporal score, the

following tags might be displayed in the plugin output:

1 2 ... 26 27 28 29 30 31 32 33 34 35 36 ... 60 61

Comentários a estes Manuais

Sem comentários

Red Hat NETWORK 3.6 - Guia do Utilizador Página 31

Comentários a estes Manuais

Manuais e produtos relacionados com Servidores Red Hat NETWORK 3.6 -