5

I'm wondering if there is a source available which has a list of CVE numbers and shows whether they have been patched or not (and maybe a link to a relevant patch). I know Secunia has something like this but I was wondering if there any others.

  • And this got downvoted because? – Lucas Kauffman May 14 '13 at 13:58
  • 3
    The only reliable source for stating whether or not there is a patch, is the vendor of the affected software - and they don't always make it easy to search by CVE. There are other sites that try to aggregate this data, but I wouldn't rely upon them to definitively state that there isn't a patch. – Iszi May 14 '13 at 14:13
  • Lucas, can you explain why you need any other service? Secunia has the details like the current status of the vulnerability etc. Is there some particular detail that you want and is not currently available on secunia? – void_in May 14 '13 at 14:14
  • @void_in I thought you can't use secunia unless you pay them large amounts of money. Also it would be nice to have some kind of verification against secunia. – Lucas Kauffman May 14 '13 at 14:20
  • 2
    Secunia advisories is a free service. You'd need to pay if you used their software (CSI). US-CERT is good for this stuff also - they've a good vulnerability database. Besides that I agree with @Iszi in terms of validating on vendor sites. – AndyMac May 14 '13 at 14:23
5

I'm not aware of any good out-of-the-box services, but I usually cross-reference with sites like:

  • SecurityFocus: It usually references CVE. Patch status filed under "Solution".

  • PacketStormSecurity: Allows fulltext search (can search for CVE ID). Patch status filed under "Mitigation".

  • OSVDB: Has an option to search with CVE ID. Patch status filed under "Solution".

  • IBM XForce: Allows CVE ID search. Patch status filed under "Remediation".

3

The National Vulnerability Database offer searching the vulnerability database using the CVE number. The details include patch information as well as resource links for the available patch on the vendor's website (if patch is available). When you search a vulnerability, the details include a section called References to Advisories, Solutions, and Tools. In that section, look at the Type: Advisory.

0

I use the link below to do lookups (similar to a pivot table- except in MySQL) to link Microsoft KBs to the CVEs they cover...keep in mind the supersede column- this can be hairy when writing logic, especially if your SOP for patching is not the latest and greatest and more or less duct tape and nails. This will only work for MS products obviously- but makes targeting advertisements for infrastructure like SCCM very easy and in my experience accurate. Depending how large your environment is you could achieve a similar vlookup in excel. 3rd party becomes extensively more and more manual and scripted BUT instead of superseding KBs most vendors are decent at just changing the version numbers. I have written my own vulnerability management software in powershell and Python based entirely off these lookups. :)

https://www.microsoft.com/en-us/download/details.aspx?id=36982

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.