4

I'm looking to improve the security posture of a web app specifically with respect to OWASP A9 - Using Components with Known Vulnerabilities.

Is anyone aware of any comprehensive data sources aside from the NVD/CVE DB that I might use instead of relying on each library's vendor/author? The NVD is far from comprehensive, and manually searching each site is tedious, so I'm hoping to find some better method (not product or service) to approach this.

Improve this question
3
  • 1
    Black Duck has the Open Hub: openhub.net/explore/projects
    – schroeder ♦
    Commented Apr 5, 2016 at 14:30
  • This question likely won't go anywere as it's a bit of a product recommendation (which the mods in their wisdom have decided is off-topic) with that said you could also look at source clear (srcclr.com) as I believe their product covers this kind of area
    – Rory McCune
    Commented Apr 5, 2016 at 14:56
  • 2
    I was concerned that people might interpret it that way, but I'm trying to carefully focus on information sources, not products that ingest them.
    – Jesse K
    Commented Apr 5, 2016 at 15:26

2 Answers 2

Reset to default
3

I did something similar a while back to ensure we were keeping up with security updates. It's all manual, though: I can't help you automate it but I can tell you how long it took me and give an example of what I ended up using.

The initial setup took a couple days (we use > 75 libraries), and since then it's just been an hour or less per week to maintain it (not counting the time to actually update the libraries we use). I ended up with a matrix in a spreadsheet, with a row for each library we used. Then the columns were:

  • version we use
  • last version I checked
  • NEWS file (any issues I identified from scanning the NEWS or other readme files provided by the library)
  • CVEs (known to exist in our version)
  • latest version available from our vendor (we don't pull directly from upstream)
  • status, which says "OK" if NEWS and CVEs are empty and latest-version-checked matches latest-version-available, or I manually set it to some other status like "needs future fix" or whatever is appropriate
  • notes

I filled out the table with our libraries and their versions, then downloaded the full CVE database in text format and used a good text editor to search it for each of our applications. If there were any CVEs for our libraries I listed them in the CVE column and added notes about the version where they were fixed and/or why they applied to us (or in the case of some well-known CVEs, why they didn't).

I also skimmed the NEWS files for most of the libraries that had newer versions available than what we were using, though I gave up on that after a while when it didn't yield anything useful that wasn't already captured in a CVE.

Then I subscribed to an RSS feed of newly-categorized CVEs. It's fairly low-volume, though bursty, so when new CVEs come in I quickly scan them for issues and update my spreadsheet if there's anything that applies to us.

I also made a cron job to scan a different list of newly-filed CVEs, but that didn't seem to add any value beyond what the NVD RSS feed provided.

Improve this answer
3
  • Thanks for the feedback. This is more or less what I'm currently doing. However, there are a couple of problems I've identified with this approach. More than anything else, lots of vendors/authors never get CVE IDs for their security flaws, for example this one from angular.js: github.com/angular/angular.js/pull/13453 I can't even find a mention of angular in the NVD, but there is an entry in the (new to me) srcclr: srcclr.com/security/arbitrary-code-execution-through-svg/…
    – Jesse K
    Commented Apr 5, 2016 at 17:39
  • 2
    seen cve-search/cve-search ?
    – atdre
    Commented Apr 5, 2016 at 18:58
  • cve-search looks like it might be a useful tool to automate CVE searches, but it's still shy of a comprehensive approach to the problem.
    – Jesse K
    Commented Apr 6, 2016 at 16:10
1

Security Tracker has a search capability to comb multiple sources for reported vulnerabilities:

http://securitytracker.com/search/search.html

Good luck!

edit: sorry, ST doesn't search eternal sites, everything is internal to ST itself. I personally use it as one information source (free version). Not sure why I'm getting down voted.

Improve this answer
2
  • I didn't downvote, but I suspect it's because the OP specifically asked for a method or process, not a product, service, or website. It would also help if you added some info about where ST gets its info from. Is it just a re-hash of the CVE db, or does it pull in something else?
    – Mike Ounsworth
    Commented Apr 6, 2016 at 13:22
  • Do you have a method for consuming data from ST that's non-manual?
    – Jesse K
    Commented Apr 6, 2016 at 16:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .