I'm wondering if there is a source available which has a list of CVE numbers and shows whether they have been patched or not (and maybe a link to a relevant patch). I know Secunia has something like this but I was wondering if there any others.
I'm not aware of any good out-of-the-box services, but I usually cross-reference with sites like:
SecurityFocus: It usually references CVE. Patch status filed under "Solution".
PacketStormSecurity: Allows fulltext search (can search for CVE ID). Patch status filed under "Mitigation".
OSVDB: Has an option to search with CVE ID. Patch status filed under "Solution".
IBM XForce: Allows CVE ID search. Patch status filed under "Remediation".
The National Vulnerability Database offer searching the vulnerability database using the CVE number. The details include patch information as well as resource links for the available patch on the vendor's website (if patch is available). When you search a vulnerability, the details include a section called References to Advisories, Solutions, and Tools. In that section, look at the Type: Advisory.
I use the link below to do lookups (similar to a pivot table- except in MySQL) to link Microsoft KBs to the CVEs they cover...keep in mind the supersede column- this can be hairy when writing logic, especially if your SOP for patching is not the latest and greatest and more or less duct tape and nails. This will only work for MS products obviously- but makes targeting advertisements for infrastructure like SCCM very easy and in my experience accurate. Depending how large your environment is you could achieve a similar vlookup in excel. 3rd party becomes extensively more and more manual and scripted BUT instead of superseding KBs most vendors are decent at just changing the version numbers. I have written my own vulnerability management software in powershell and Python based entirely off these lookups. :)