4

I'm looking to improve the security posture of a web app specifically with respect to OWASP A9 - Using Components with Known Vulnerabilities.

Is anyone aware of any comprehensive data sources aside from the NVD/CVE DB that I might use instead of relying on each library's vendor/author? The NVD is far from comprehensive, and manually searching each site is tedious, so I'm hoping to find some better method (not product or service) to approach this.

  • Black Duck has the Open Hub: openhub.net/explore/projects – schroeder Apr 5 '16 at 14:30
  • This question likely won't go anywere as it's a bit of a product recommendation (which the mods in their wisdom have decided is off-topic) with that said you could also look at source clear (srcclr.com) as I believe their product covers this kind of area – Rоry McCune Apr 5 '16 at 14:56
  • 2
    I was concerned that people might interpret it that way, but I'm trying to carefully focus on information sources, not products that ingest them. – Jesse K Apr 5 '16 at 15:26
3

I did something similar a while back to ensure we were keeping up with security updates. It's all manual, though: I can't help you automate it but I can tell you how long it took me and give an example of what I ended up using.

The initial setup took a couple days (we use > 75 libraries), and since then it's just been an hour or less per week to maintain it (not counting the time to actually update the libraries we use). I ended up with a matrix in a spreadsheet, with a row for each library we used. Then the columns were:

  • version we use
  • last version I checked
  • NEWS file (any issues I identified from scanning the NEWS or other readme files provided by the library)
  • CVEs (known to exist in our version)
  • latest version available from our vendor (we don't pull directly from upstream)
  • status, which says "OK" if NEWS and CVEs are empty and latest-version-checked matches latest-version-available, or I manually set it to some other status like "needs future fix" or whatever is appropriate
  • notes

I filled out the table with our libraries and their versions, then downloaded the full CVE database in text format and used a good text editor to search it for each of our applications. If there were any CVEs for our libraries I listed them in the CVE column and added notes about the version where they were fixed and/or why they applied to us (or in the case of some well-known CVEs, why they didn't).

I also skimmed the NEWS files for most of the libraries that had newer versions available than what we were using, though I gave up on that after a while when it didn't yield anything useful that wasn't already captured in a CVE.

Then I subscribed to an RSS feed of newly-categorized CVEs. It's fairly low-volume, though bursty, so when new CVEs come in I quickly scan them for issues and update my spreadsheet if there's anything that applies to us.

I also made a cron job to scan a different list of newly-filed CVEs, but that didn't seem to add any value beyond what the NVD RSS feed provided.

  • Thanks for the feedback. This is more or less what I'm currently doing. However, there are a couple of problems I've identified with this approach. More than anything else, lots of vendors/authors never get CVE IDs for their security flaws, for example this one from angular.js: github.com/angular/angular.js/pull/13453 I can't even find a mention of angular in the NVD, but there is an entry in the (new to me) srcclr: srcclr.com/security/arbitrary-code-execution-through-svg/… – Jesse K Apr 5 '16 at 17:39
  • 1
    "Vendor doesn't report security issue" - yeah I have no solution for that, either! Anyway I've set the bar with this answer and I'm hoping, too, someone will come along with a better one :) – drewbenn Apr 5 '16 at 18:04
  • 2
    seen cve-search/cve-search ? – atdre Apr 5 '16 at 18:58
  • 1
    @atdre you should write that up as an answer! It looks like it's a little more setup work than what I've done but would be well worth it if multiple teams were going to use it. – drewbenn Apr 6 '16 at 5:39
  • cve-search looks like it might be a useful tool to automate CVE searches, but it's still shy of a comprehensive approach to the problem. – Jesse K Apr 6 '16 at 16:10
1

Security Tracker has a search capability to comb multiple sources for reported vulnerabilities:

http://securitytracker.com/search/search.html

Good luck!

edit: sorry, ST doesn't search eternal sites, everything is internal to ST itself. I personally use it as one information source (free version). Not sure why I'm getting down voted.

  • I didn't downvote, but I suspect it's because the OP specifically asked for a method or process, not a product, service, or website. It would also help if you added some info about where ST gets its info from. Is it just a re-hash of the CVE db, or does it pull in something else? – Mike Ounsworth Apr 6 '16 at 13:22
  • Do you have a method for consuming data from ST that's non-manual? – Jesse K Apr 6 '16 at 16:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.