Assessing vulnerability of service-providing software packages
Methods and systems for assessing a vulnerability of a network device. The systems and methods described herein combine data regarding locally discovered vulnerabilities and exposed services with data regarding what executables are provided by software installed on the network device.
1. A method comprising:
performing, by one or more computing devices:
maintaining a database of known vulnerabilities associated with respective software packages;
gathering data about hosts in a network, including a list of one or more externally exposed services provided by a host;
determining a software package installed on the host that is used to provide a service in the list, comprising:
determining a process on the host that is providing the service,
determining an open file that is opened by the process, and
determining that the open file is associated with the software package;
determining that the service is vulnerable based on a matching of the software package to information in the database of known vulnerabilities; and
executing a remedial action in response to determining that the service is vulnerable.
2. The method of claim 1 , wherein determining that the software package is used to provide the service includes determining a version of the software package.
3. The method of claim 1 , wherein determining that the software package is used to provide the service includes:
logging onto the host using an authentication credential; and
executing commands on the host to determine the process, the open file, and the software package.
4. The method of claim 3 , wherein the authentication credential is stored in the database.
5. The method of claim 3 , wherein the gathering of the data about the hosts is performed by scanning ports of the hosts before logging onto the hosts.
6. The method of claim 5 , wherein the list of the one or more externally exposed services on the host indicates a port or protocol associated with each of the one or more externally exposed services.
7. The method of claim 1 , wherein executing the remedial action includes elevating the software package for further examination.
8. The method of claim 1 , wherein executing the remedial action includes issuing an alert.
9. The method of claim 1 , wherein the remedial action is issued as a visual alert on a user interface.
10. A system comprising:
one or more computing devices, each comprising one or more non-transitory computer readable media storing program instructions that when executed on one or more processors cause the one or more processors to:
maintain a database of known vulnerabilities associated with respective software packages;
gather data about hosts in a network, including a list of one or more externally exposed services provided by a host;
determine a software package installed on the host that is used to provide a service in the list, comprising:
determining a process on the host that is providing the service,
determining an open file that is opened by the process, and
determining that the open file is associated with the software package;
determine that the service is vulnerable based on a matching of the software package to information in the database of known vulnerabilities; and
execute a remedial action in response to determining that the service is vulnerable.
11. The system of claim 10 , wherein the one or more computing devices is configured to determine a version of the software package.
12. The system of claim 10 , wherein to determine that the software package is used to provide the service, the one or more computing devices is configured to:
log onto the host using an authentication credential; and
execute commands on the host to determine the process, the open file, and the software package.
13. The system of claim 12 , wherein the authentication credential is stored in the database.
14. The system of claim 12 , wherein to gather the data about the hosts, the one or more computing devices is configured to scan ports of the hosts before logging onto the hosts.
15. The system of claim 14 , wherein the list of the one or more externally exposed services on the host indicates a port or protocol associated with each of the one or more externally exposed services.
16. The system of claim 10 , wherein to execute the remedial action, the one or more computing devices is configured to issue an alert via a user interface.
17. One or more non-transitory computer readable media storing program instructions that when executed on one or more processors cause the one or more processors to:
maintain a database of known vulnerabilities associated with respective software packages;
gather data about hosts in a network, including a list of one or more externally exposed services provided by a host;
determine a software package installed on the host that is used to provide a service in the list, comprising:
determining a process on the host that is providing the service,
determining an open file that is opened by the process, and
determining that the open file is associated with the software package;
determine that the service is vulnerable based on a matching of the software package to information in the database of known vulnerabilities; and
execute a remedial action in response to determining that the service is vulnerable.