Automated software vulnerability determination
Software vulnerabilities affecting devices can be determined using a vulnerability identifier uniquely identifying a vulnerability and version check information for use in determining software versions affected by the vulnerability. The version check information comprises one or more version rules providing a definition of how a software version number is tokenized and one or more Boolean expressions on those tokens to identify impacted versions of software according to the one or more version rules. In checking software for a vulnerability, the software version is determined and checked using the Boolean expression according to the version definition.
1. A method for determining if a software component is susceptible to a vulnerability, the method comprising:
accessing a vulnerability listing object comprising:
a vulnerability identifier uniquely identifying a software vulnerability; and
vulnerability causes information for use in determining software affected by the vulnerability, the vulnerability causes information comprising:
affected patch information specifying a vulnerable patch that associates a patch token with patch details identifying one or more corrective software patches and one or more patch locations for retrieving the one or more corrective software patches; and
a first affected patch Boolean expression specifying which ones of the one or more corrective software patches should be retrieved from the one or more patch locations and applied to the software to fix the vulnerability;
determining information indicating which ones of the specified corrective software patches have been successfully applied to the software and which ones of the specified corrective patches have not been successfully applied to the software;
applying the information to the first affected patch Boolean expression;
determining whether the first affected patch Boolean expression is true or not true;
indicating that the software component is susceptible to the software vulnerability when the first affected patch Boolean expression is determined to be true; and
indicating that the software component is not susceptible to the software vulnerability when the first affected patch Boolean expression is determined to be not true, wherein the vulnerability listing object further comprises version check information comprising:
one or more version rules providing a version definition of how a software version number is formed from a plurality of tokens; and
a version Boolean expression using one or more of the plurality of tokens, the version Boolean expression identifying software versions associated with the vulnerability listing object.
2. The method of claim 1 , wherein the vulnerability listing object further comprises information for fixing the vulnerability.
3. The method of claim 2 , wherein the information for fixing the vulnerability comprises:
a second affected patch Boolean expression specifying one or more corrective patch tokens, which if applied as specified in the second affected patch Boolean expression fix the vulnerability; and
corrective patch information for each of the one or more corrective patch tokens each associating the respective corrective patch token with a respective corrective patch location for retrieving the respective corrective patch token.
4. The method of claim 3 , further comprising:
determining which of the one or more corrective patch tokens to apply based on the second affected patch Boolean expression;
determining the respective corrective patch location from the corrective patch information;
retrieving one or more corrective patches from the respective corrective patch locations; and
applying each of the retrieved corrective patches.
5. The method of claim 4 , further comprising:
determining if each of the one or more retrieved corrective patches were successfully applied; and
if one or more of the corrective patches were not successfully applied, providing a notification that one or more of the corrective patches were not successfully applied.
6. The method of claim 1 , further comprising retrieving the vulnerability listing object from a network location provided by a base location comprising a website domain followed by a predetermined location identifier.
7. The method of claim 6 , wherein the base location further comprises one or more of:
a subdomain; and
a path identifier.
8. The method of claim 6 , wherein the vulnerability listing object further comprises:
a product identifier indicating a software product; and
one or more vulnerabilities affecting the product.
9. The method of claim 8 , wherein the one or more vulnerabilities are specified within the vulnerability listing object indirectly by referencing a second vulnerability listing object.
10. The method of claim 1 , further comprising determining one or more software components to be checked, wherein the software components to be checked are located on one or more of:
a device that the method is performed by; and
one or more devices different from the device that the method is performed by.
11. The method of claim 1 ,
wherein the version check information is used to determine if software is vulnerable by:
determining a version number of a software component to be checked for susceptibility to the software vulnerability; and
applying the determined version number to the version Boolean expression according to the one or more version rules.
12. A device for determining if a software component is susceptible to a vulnerability, the device comprising:
a processor for executing instructions; and
a memory for storing instructions, which when executed by the processor configure the device to:
access a vulnerability listing object comprising:
a vulnerability identifier uniquely identifying a software vulnerability; and
vulnerability causes information for use in determining software affected by the vulnerability, the vulnerability causes information comprising:
affected patch information specifying a vulnerable patch that associates a patch token with patch details identifying one or more corrective software patches and one or more patch locations for retrieving the one or more corrective software patches; and
a first affected patch Boolean expression specifying which ones of the one or more corrective software patches should be retrieved from the one or more patch locations and applied to the software to fix the vulnerability;
determine information indicating which ones of the specified corrective software patches have been successfully applied to the software and which ones of the specified corrective patches have not been successfully applied to the software;
apply the information to the first affected patch Boolean expression;
determine whether the first affected patch Boolean expression is true or not true;
indicate that the software component is susceptible to the software vulnerability when the first affected patch Boolean expression is determined to be true; and
indicate that the software component is not susceptible to the software vulnerability when the first affected patch Boolean expression is determined to be not true, wherein the vulnerability listing object further comprises version check information comprising:
one or more version rules providing a version definition of how a software version number is formed from a plurality of tokens; and
a version Boolean expression using one or more of the plurality of tokens, the version Boolean expression identifying software versions associated with the vulnerability listing object.
13. The device of claim 12 , wherein the vulnerability listing object further comprises information for fixing the vulnerability.
14. The device of claim 13 , wherein the information for fixing the vulnerability comprises:
a second affected patch Boolean expression specifying one or more corrective patch tokens, which if applied as specified in the second affected patch Boolean expression fix the vulnerability; and
corrective patch information for each of the one or more corrective patch tokens each associating the respective corrective patch token with a respective corrective patch location for retrieving the respective corrective patch token.
15. The device of claim 14 , wherein the executed instructions further configure the device to:
determine which of the one or more corrective patch tokens to apply based on the second affected patch Boolean expression;
determine the respective corrective patch location from the corrective patch information;
retrieve one or more corrective patches from the respective corrective patch locations; and
apply each of the retrieved corrective patches.
16. The device of claim 15 , wherein the executed instructions further configure the device to:
determine if each of the one or more retrieved corrective patches were successfully applied; and
if one or more of the corrective patches were not successfully applied, provide a notification that one or more of the corrective patches were not successfully applied.
17. The device of claim 12 , wherein the executed instructions further configure the device to retrieve the vulnerability listing object from a network location provided by a base location comprising a website domain followed by a predetermined location identifier.
18. The device of claim 17 , wherein the base location further comprises one or more of:
a subdomain; and
a path identifier.
19. The device of claim 18 , wherein the vulnerability listing object further comprises:
a product identifier indicating a software product; and
one or more vulnerabilities affecting the product.
20. The device of claim 19 , wherein the one or more vulnerabilities are specified within the vulnerability listing object indirectly by referencing a second vulnerability listing object.
21. The device of claim 12 , wherein the executed instructions further configure the device to determine one or more software components to be checked, wherein the one or more software components to be checked are located on one or more of:
the device; and
one or more external devices different from the device.
22. The device of claim 12 ,
wherein the version check information is used to determine if software is vulnerable by:
determining a version number of a software component to be checked for susceptibility to the software vulnerability; and
applying the determined version number to the version Boolean expression according to the one or more version rules.