Vulnerability inference
Systems and methods for determining an extent of a vulnerability on a computer and remediating the vulnerability. An installed resource set comprising shared software resources installed on the computer is enumerated. A vulnerable resource is identified in the installed resource set. A vulnerable process set including at least one vulnerable process that uses the vulnerable resource is enumerated. And, the vulnerable process is remediated.
1. A method for determining an extent of a vulnerability comprising:
obtaining a list of resources installed on a computer;
identifying from the obtained list at least one library that is used by one or more processes executing on the computer;
enumerating a library set comprising at least one library that is by one or more processes executing on the computer;
identifying a vulnerable library in the enumerated library set;
executing a reverse-dependency function to determine at least one process that uses the vulnerable library;
enumerating a vulnerable process set comprising at least one vulnerable process executing on the computer that uses the vulnerable library and is therefore vulnerable as a result of using the vulnerable library; and
remediating the at least one vulnerable process by performing at least one of:
terminating the at least one vulnerable process, and
updating the vulnerable library used by the at least one vulnerable process.
2. The method according to claim 1 , wherein remediating the at least one vulnerable process comprises at least one of: uninstalling the vulnerable library used by the at least one vulnerable process, and uninstalling software implementing the at least one vulnerable process.
3. The method according to claim 1 , wherein identifying the vulnerable library comprises retrieving a version number associated with a shared library in the installed library set and identifying a vulnerability associated with the retrieved version number of the shared software library.
4. The method according to claim 1 , wherein the library set comprises a remotely-accessible resource being made accessible by the computer through a network interface.
5. The method according to claim 1 , further comprising connecting to the computer via at least one of: connecting to the computer using a network and connecting to the computer using a local interface.
6. The method according to claim 1 , wherein the enumerated vulnerable process set comprises at least one of: an active process, an inactive process, a local process, a remote process, and a process communicative over a network.
7. The method according to claim 1 , wherein enumerating the vulnerable process set further comprises querying the computer for metadata associated with a process using the vulnerable library.
8. A system configured to determine the extent of a vulnerability, comprising:
a network interface configured to communicate by way of a network;
a memory configured to store instructions; and
a processor to execute the instructions to perform operations comprising:
obtaining a list of resources installed on the computer;
identifying from the obtained list at least one library that is used by one or more processes executing on the computer;
enumerating a library set comprising at least one library that is used by one or more processes executing on the computer;
identifying a vulnerable library in the enumerated library resource set;
executing a reverse-dependency function to determine at least one process that uses the vulnerable library;
enumerating a vulnerable process set comprising at least one vulnerable process executing on the computer that uses the vulnerable library and is therefore vulnerable as a result of using the vulnerable library; and
remediating the at least one vulnerable process by performing at least one of:
terminating the at least one vulnerable process, and
updating the vulnerable library used by the at least one vulnerable process.
9. The system according to claim 8 , wherein remediating the at least one vulnerable process comprises at least one of: uninstalling the vulnerable library used by the at least one vulnerable process, and uninstalling software implementing the at least one vulnerable process.
10. The system according to claim 8 , wherein identifying the vulnerable library comprises retrieving a version number associated with a shared library in the installed library set and identifying a vulnerability associated with the version number of the shared library.
11. The system according to claim 8 , wherein the library set comprises a remotely-accessible resource being accessible to the computer by way of the network interface.
12. The system according to claim 8 , further comprising connecting to the computer via at least one of: connecting to the computer using the network and connecting to the computer using a local interface.
13. The system according to claim 8 , wherein the enumerated vulnerable process set comprises at least one of: an active process, an inactive process, a local process, a remote process, and a process communicative over the network.
14. The system according to claim 8 , wherein enumerating the library set comprises querying a package management system associated with the computer.
15. A non-transitory computer readable media storing instructions that are executable by a processing device, and upon such execution cause the processing device to perform operations comprising:
obtaining a list of resources installed on the computer;
identifying from the obtained list at least one library that is used by one or more processes executing on the computer;
enumerating a library set comprising at least one library that is used by one or more processes executing on the computer;
identifying a vulnerable library in the enumerated library resource set;
executing a reverse-dependency function to determine at least one process that uses the vulnerable library;
enumerating a vulnerable process set comprising at least one vulnerable process executing on the computer that uses the vulnerable library and is therefore vulnerable as a result of using the vulnerable library; and
remediating the at least one vulnerable process by performing at least one of:
terminating the at least one vulnerable process, and
updating the vulnerable library used by the at least one vulnerable process.
16. The non-transitory computer readable media according to claim 15 , wherein remediating the at least one vulnerable process, comprises at least one of: uninstalling the vulnerable library used by the at least one vulnerable process, and uninstalling software implementing the at least one vulnerable process.