Fast comparison of Nessus and OpenVAS knowledge bases. In my opinion, quality of knowledge base is the most important characteristic of Vulnerability Management (VM) product. Maybe it’s because I have spent significant amount of time making different security content for vulnerability scanners and this is some form of professional deformation. 🙂 The fact is that nowadays we have dozens of VM solutions on the market, which have very different knowledge bases and thus different abilities for detecting vulnerabilities. And really nobody talk about this. I can recommend related post “Tenable doesn’t want to be Tenable anymore” and especially HD Moore’s comment to that post. It describes the reason why nobody interested now in quality of detection. Maximum what we, end-users, can hear from the vendor about it’s knowledge base is an amount of vulnerability checks: 40000-80000 and approximate list of supported systems. There is a massive false belief that detection quality of the products is approximately the same and it’s better talk about dashboards, reports, SIEM-like capabilities. To demonstrate that the difference actually exists I made a pretty primitive comparison of Nessus and OpenVAS knowledge bases.

I chose these two products, mainly because information on their NASL plugins is available at Vulners.com. As I also wrote earlier how you can use easily parse Vulners archives in python, so you can repeat it for yourself. I talked about this topic at Pentestit webinar about Vulners. If you are familiar with Russian, you can also check this out. 😉 The slides for this presentation are available here.

Why I call this comparison fast and primitive? I don’t define the structure of KBs for this product and don’t carefully map one nasl script to another. I suppose it may be a theme for another posts. Instead I am looking at the CVE links. If two scanners detect can the same vulnerabilities, they should have the same CVE links in all the NASL scripts, right? In reality we have a great difference between the products and more than a half of the CVEs can’t be detected by using both of them.

All CVEs: 80196
OpenVAS CVE links: 29240
Nessus CVE links: 35032
OpenVAS vs. Nessus: 3787;25453;9579

We can get group of the NASL scripts, “connected” with the links to the same CVEs. There are also thousands of NASL scripts in OpenVAS and Nessus that have some CVE links and can’t be mapped anyhow to the script in different KB.

All NASL plugins:
OpenVAS: 49747
Nessus: 81349

Mapped plugins: 38207 OpenVAS and 50896 Nessus
Not mapped OpenVAS plugins: 2673
Not mapped Nessus plugins: 6639

I find the last part the most valuable and interesting. You definitely can use it to clarify the weak sides of your vendor’s solutions. What are the reasons of such difference? Well, it of course may be an error. Vendor haven’t added a link to the CVE id, but the check actually exists. That’s why this method of comparison is far from ideal.

Other reasons why vendor may ignore vulnerabilities:

• “Old” software and vulnerabilities. Vendor may think, that keeping vulnerabilities for some old software is useless. Well, for some vulnerabilities in non-supported Linux distributions, like Mandrake Linux, it can make sense.
• Vulnerabilities in plugins for some software. E.g. OpenVAS detects “WordPress VideoWhisper Live Streaming Integration Multiple Vulnerabilities“, Nessus not.
• “Local” software. E.g. OpenVAS detects vulnerabilities for French project “openMairie“, Nessus not.
• Non-enterprise software and devices. E.g. OpenVAS detects “D-Link DIR-100 Router Multiple Vulnerabilities“, Nessus not.
• Stopped adding new vulnerabilities for the software. E.g. OpenVAS detects “vBulletin 3.6.x to 4.2.2/4.2.3 Forumrunner ‘request.php’ SQL Injection“, Nessus not. Nessus detects Solaris vulnerabilities since 2010, OpenVAS not.

In other words:

• Vulnerability Scanner is a necessity
• However, don’t depend too much on them
• If Vulnerability Scanner does not detect some vulnerability — it’s YOUR problem not your VM vendor
• Choose VM solution you can control
• Have alternative sources of Vulnerability Data (vulners.com, vFeed)

So, once again. The reason of this post is not to say, that one vendor is better than another. Both Openvas and Nessus have their great sides. However, there are certain gaps in knowledge bases of vulnerability management products and I believe they can be fixed in dialogue of regulators, VM vendors, Security Content developers, and independent security practitioners.

Alexander Leonov

Hi! My name is Alexander and I am a Vulnerability Management specialist. You can read more about me here. Currently, the best way to follow me is my Telegram channel @avleonovcom. I update it more often than this site. If you haven’t used Telegram yet, give it a try. It’s great. You can discuss my posts or ask questions at @avleonovchat.

А всех русскоязычных я приглашаю в ещё один телеграмм канал @avleonovrus, первым делом теперь пишу туда.