So the final verdict RE Andrew Court's original post is this:
(1) If you're running a version of Windows that records hotfixes in the
registry, and you trust the information in the registry, you can use the
Nessus KB items set by Plugin 13855 to get information about installed
hotfixes (e.g., using the custom plugin I posted for him).
(2) If you're running a version of Windows that does not consistently
record hotfixes in the registry (like Vista), or you don't trust the
information in the registry, you cannot use Nessus KB information to
generate a list of installed hotfixes BECAUSE the smb_nt_msXX-XXX.nasl
plugins only report NEGATIVE results and do not store any results
(negative or positive) in the KB.
It would be useful for the smb_nt_msXX-XXX.nasl scripts to store
information in the KB, but there'd probably be a trade-off in
performance. Perhaps this can be tied to the verbosity level set in the
nessusrc file?
John Scherff
24 Hour Fitness
-----Original Message-----
From: nessus-bounces@list.nessus.org
[mailto:nessus-bounces@list.nessus.org] On Behalf Of Renaud Deraison
Sent: Friday, November 02, 2007 8:03 AM
To: Nessus List
Subject: Re: Plugin 13855 - installed hotfixes
On Nov 2, 2007, at 10:50 AM, Pavithra H wrote:
Hi Renaud,
Thanks for the info.
I have a quick query for you! What was basic idea to rely on registry
entries to check for the hotfix installation?
Checking the registry was faster and easier for us given the SMB
implementation we had at the time.
As you said, nowadays it is cumbersome to rely on registries to
confirm patch installation. Does checking dll file versions will be a
better method to overcome this issue?
Yes, looking at the DLL is definitely more reliable and that's what we
intend to stick to.
-- Renaud
_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus
_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus
