Minimum quality of detection

Scanning / scan configuration
1

We got an alert about an old version of nginx (1.20.1) from some other tool and i tried to figure out why our installation of Greenbone hadn’t flagged it even though “cpe:/a:f5:nginx:1.20.1” and “cpe:/a:nginx:nginx:1.20.1” is listed in the cpe inventory result for the host.

After some digging i think i understand part of it:

  • plugins/2022/nginx/gb_nginx_eol.nasl in the community feed might have flagged it but sets qod_type to remote_banner_unreliable (because nginx is often installed from distributions that backport security fixes)
  • remote_banner_unreliable is translated to 30% by qod_from_type in gvmd/src/manage_sql.c
  • our scans tasks have min qod 70%

This led me to try a scan task with min qod set to 30% but i still didn’t get an eol result for nginx 1.20.1 so now i have some questions:

  • Should my change of min qod have had the effect i anticipated?
  • If so, any ideas about what else i did wrong?
  • Also if so when is the min qod applied? (In selecting nvts or after nvts have produced results?)
  • If not what does the min qod field do?
  • Is there some other way to get results with low qod from scans that i overlooked?

As an aside i stumbled over the cve scanner and how it’s used when looking into this and am working on adding that to our process but the results from that one always seem to have qod 75% (and less informative nvt names) so i think we would prefer the results from Openvas default if i could make them materialise.

2

I finally realised that besides the default min qod for tasks that i’d already changed there’s a default min qod when displaying results that needs to be lower by adding for instance min_qod=30 in the filter bar. (Even searches for qod=30 return nothing until this is done.)

The only question that remains is if the min qod in a task is applied when Greenbone selects nvts or after nvts have produced results.

3

@ulrik make sure that nginx version banner is visible on server and also checks for logs to see executed plugins..

Eero

4

I haven’t checked that on the scanned host itself but as Greenbone got the cpe record i assume the version banner is visible.

Checking the logs is a good idea but nothing was noted with default log levels. Do you happen to know which facility i need to include debug logs for to see which nvts are started? (sd main, lib misc, lib nasl, libgvm base, libgvm boras, libgvm util, *)

5

Looks like it would be sd main if there was any logging of nasl start.

In the end i added a g_debug call to nasl_thread in openvas-scanner/src/nasl_plugins.c and asked for debug logging for sd main. Even with min qod 70 gb_nginx_eol.nasl is started so it seems min qod is applied after the nvts have produced results.

1 Like