Re: update-nessusrc script usage

On Wed, Feb 22, 2006 at 02:40:23PM -0800, Ameet Zaveri wrote:

> I am using the update-nessusrc script to keep the NessusClient
> config file updated. With the default settings, it disables all
> the "dangereous" plugins in the Denial of Service family. 

My update-nessusrc script disables by default "dangerous" plugins, which
are defined as those in the ACT_DENIAL, ACT_DESTRUCTIVE_ATTACK,
ACT_FLOOD, and ACT_KILL_HOST *categories*, not families. The former
refer to how the plugin behaves while the later reflect the type of flaw
covered by the plugin.

Consider, for example, plugin 20394 (eims_328.nasl). Since it is
checking for DoS flaws in Eudora Internet Mail Server, it belongs in the
"Denial of Service" family; but since it only checks various service
banners, it's in the ACT_GATHER_INFO category.

> It
> also seems to disable some plugins in "CGI Abuses" family. 

"Seems to"?  Have you run the script in debug mode and examined its output?

> Is
> this as designed? The plugin ids are 20922-20928. Are these
> supposed to be dangerous.

No, that's not how it should work. And given that the plugins you list
form a nice and somewhat recent sequence, I suspect something else is
happening. Did you update plugins on the server without subsequently
running update-nessusrc? What are the statuses of plugins such as 20950
- 20961?

George
-- 
theall@tenablesecurity.com
_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus