9

Canonical question regarding the best way of obtaining information on what vulnerabilities X product has had/has. Other identical or significantly similar questions should be closed as a duplicate of this one. This is as per Schroeders suggestion in the following How should questions be handled that are part on-topic and part off-topic?

  • What is the most effective / best method for obtaining information in regards to what vulnerabilities X device has or has had?
  • Is there anything else I can do short of checking the security advisories page?
  • What if there is no security advisory page where else can I go?
  • What are some good resources I can use to find such vulnerabilities?
5

What is the most effective / best method for obtaining information in regards to what vulnerabilities X device has or has had?

Checking the vendor's security advisories page is always a good start, anything they know about will usually go on there. As an example, here is a link to the Cisco Security Advisories page.


Is there anything else I can do short of checking the security advisories page?

Yes, there is. For example, any "major" vulnerabilities will be assigned a CVE these will also be very helpful in identifying whether or not a specific product has X vulnerability or not. A good resource for this is CVE Details


What if there is no security advisory page where else can I go?

If there isn't a security advisory on the vendor page then a few things could be applicable.

  • The vendor doesn't yet know if they are affected.
  • They're not aware of the vulnerability.
  • They aren't affected.

What should you do in this scenario? A good idea would be to contact the Vendors support teams. Going back to the Cisco example you could use Cisco TAC. This would be applicable to all vendors, if there is no public information on the device in question your best chance is to contact their support teams and find out.

If they are not aware of the vulnerability it would be a good idea to inform them of the issue, especially if you found it whilst doing some digging and it appears obscure. If you cannot find any resources from the vendor themselves (whether they know about it or not) inform them, I can almost safely say it will help. In the Cisco example, you could contact Product Security Incident Response Team


What are some good resources I can use to find such vulnerabilities?

There are a lot of websites you can use other than the ones mentioned, the two below might also be helpful as mentioned by @Elsadek.

You could also use CVE checkers as mentioned by @Forest.

Another idea might be to subscribe to a security mailing list like the one below originally mentioned by @Forest.

Open Source Security Mailing List

This specifically is quite generalised however there are ones you could use which are more specific, as I mentioned earlier you could subscribe to Ciscos for example.

1

There are multiple utilities which can check installed software against the public CVE database, such as cve-check-tool and cvechecker. These tools will compare your reported software versions against known vulnerable versions, but will not attempt to exploit your software. Many Linux distributions also keep a list of distribution-specific security advisories. Their package managers can often be configured to log instances when you are using software with a known security issue.

You can also look on various advisory websites. Some, like cvedetails, are easy to search through but not always up to date or complete. More vendor-specific advisories such as DSA for Debian go into more detail and are more comprehensive. You can also simply search the name and version of your software along with the word "cve" to get many relevant results. This is what I often do. Another technique is to read the security mailing list for the software or a more general security-oriented mailing list like oss-sec, which discusses vulnerabilities for popular open source software.

1

A good strategy would be to subscribe to the security mailing list for the technology stack you are operating, this can be done via the vendor websites or using updated third party vulnerability databases like SecurityFocus and Exploits Database.

On SecurityFocus you can browse vulnerabilities history by vendor and product version.

What if there is no security advisory page where else can I go?

In this case you are probably among the users who first discovered the vulnerability, or less probably you've been accidentally informed of an undisclosed vulnerability.

In this case the only thing you have to do (if you are a good guy :)) is to contact the vendor.

  • 1
    Ooo! I like your point about potentially being the first one to know about it. However - I know some vendors can be quite slow to come out with a statement (unless they found themselves). – J.J May 18 '18 at 11:54
  • 2
    Sometimes people intentionally inform you of an undisclosed vulnerability under the expectation that you won't report it. In such unfortunate cases, you often have to develop a patch on your own. Reporting it is the best way to guarantee you will no longer have a source of 0days. – forest May 19 '18 at 23:36
1

I agree with all of the above. In addition you can use https://vulners.com/ to search for a product (even with a specific version number).

Vulners basically enumerates CVE's and vulnerability reports as well as security focused blogs and posts from across the internet. You can then search for anything that may be contained in these documents.

I started using it due to their robust API, which makes things even easier. I believe they have a method of setting up a vulnerability scanner as well.

-1

Generally, exploits are given CVE numbers which can be searched for on https://www.cvedetails.com/ you can look at exploits by vendor, by product, etc.

  • 2
    I'm not sure this is true in general, or even what percentage of vulnerabilities have CVE numbers. AFAIK, there are a lot of security bugs that have never been assigned a CVE number, it varies by vendor or product or even period of time. – reed May 16 '18 at 18:11
  • @reed, This is true. But CVEs are still the most extensive and well-catalogued list but by no means will it find everything. But most very important vulnerabilities get CVEs – Nick Mckenna May 16 '18 at 18:27
  • @NickMckenna Unfortunately, although CVEs are ubiquitous, the cvedetails website is quite lacking and not at all extensive. – forest May 19 '18 at 23:38

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.