I have a list of software installed on workstations which contains product name and version, for example my list contains Mysql Workbench 6.3.8. Searching in CVE Details I found out that this software has one vulnerability CVE-2017-3469. Is there any automated tool to do this kind of search in most popular vulnerability databases? What are the others vulnerability databases that I should search?
Vulnerability Management tools are designed to do this very function. They usually are able to scan devices and lookup versions against known patch levels as well as CVEs.
There are a great many to choose from with a wide range of features.
The most crucial sources to check beside the CVE database are:
- Metasploit exploit repository
There are also a number of tools that can take a csv file of product names and versions and look them up in these sources (or you can make your own).
A tool to use would be a vulnerability scanner such as OpenVAS, Nessus or even Metasploit. Now not all 3rd party software will be in there. Other than that, there are scripts on github that offer some assistance.
Good site to search manually or script it https://cve.mitre.org/find/
I did not have much luck finding a windows one that is up to date, however I encourage you to look.
Nmap has a script for this. An NSE script called Nmap NSE Vulscan (http://www.computec.ch/mruef/software/nmap_nse_vulscan-1.0.tar.gz) that can help you to map the version information you obtain from a target machine with the vulnerability database, such as CVE from www.cve.mitre.org, OSCDB www.osvdb.org, scip VulDB www.scip.ch/?vuldb, www.SecurityFocus.com, and www.securitytracker.com
https://vulners.com/ to search for a product version number.
Vulners basically enumerates CVE's and vulnerability reports as well as security focused blogs and posts from across the internet. You can then search for anything that may be contained in these documents.
I started using it due to their robust API, which makes things even easier. I believe they have a method of setting up a vulnerability scanner as well.