I recently ran the 1st vulnerability scan in my offices network using OpenVAS. We received a great deal of false positives. Mostly I saw that (at least some) tests are unaware of internal patches in a system.
For example we were alerted to these:
CVE-2016-6515, CVE-2016-6210 on an Ubuntu 16.04 system. OpenVAS recognized the system to run
OpenSSH 7.2p2 but these were updated in
7.2p2-4ubuntu2.1 and we are using something later still.
I can see it was patched in the changelog.
We intend to scan again in the future, and not only with OpenVAS. Is there a way to avoid them without increasing the odds of false negatives? Will using an authenticated scan be better? Is there a way to handle the sources for the tests to such an end?