I’m looking for help troubleshooting an issue with OpenVAS on an openSUSE appliance.
Issue Description
OpenVAS scans complete successfully, and the target is reachable. However, package-related vulnerabilities (CVEs) are not being detected or reported for the appliance.
Environment
Target OS: openSUSE appliance
Scanner: OpenVAS / Greenbone
Feeds: Updated and synchronized
Scan execution: Successful
Observations
For the same appliance:
Nessus detects multiple package-based CVEs.
Qualys detects the same CVEs.
OpenVAS does not report these package vulnerabilities.
Troubleshooting Performed
Verified target connectivity.
Confirmed scan completion without errors.
Updated/synchronized vulnerability feeds.
Reviewed scan configuration settings.
Request for Assistance
Could anyone suggest what I should check next?
Specifically:
Are there any known limitations with openSUSE package detection in OpenVAS?
Does OpenVAS require specific settings for credentialed scans on openSUSE?
How can I verify that RPM/Zypper package enumeration is working correctly?
Are there any logs that can help confirm whether Local Security Checks (LSC) are being executed?
Has anyone experienced similar discrepancies between OpenVAS and Nessus/Qualys results?
Any troubleshooting guidance, recommended scan configurations, or known issues would be greatly appreciated.
Each Linux distribution requires distribution-specific local LSC package scripts. To my knowledge, this openSUSE release is not supported by OpenVAS. That makes sense, as it is not considered an enterprise distribution, and creating and maintaining package checks for it would require a significant amount of effort.
That explains the behavior I’m seeing. My expectation was that OpenVAS would identify package-based vulnerabilities in a similar manner to Nessus and Qualys, both of which are currently reporting multiple CVEs on the same openSUSE appliance.
If this particular openSUSE release is not supported by distribution-specific LSC package checks, that would explain why package vulnerabilities are not being reported even though the scans complete successfully.
Thanks for helping identify the root cause. This clarifies the discrepancy between OpenVAS results and those from Nessus and Qualys, and will help us set the appropriate expectations for vulnerability coverage on this platform.
Tenable and Qualys are way bigger companies, so they simply have more resources to build and properly validate their checks. Validation is a huge part of the job, and it’s easy to underestimate how much work it actually takes. They’re also significantly more expensive, so you’d expect that level of investment.
That said, the open-source version is free, so it’s hard to expect the same level of quality or coverage.
I wrote a few LSC checks for OpenVAS myself years ago, and even as a hobby project, the validation alone was a pretty big undertaking.