OpenVAS

OpenVAS DevCon #3 : Starting tomorrow

2011-07-06T13:47:00.000+01:00

Already for the third time the OpenVAS team meets in real life to discuss and plan next features of the OpenVAS framework. OpenVAS devcon #3 takes place in Osnabruck in Germany from 7th to 9th of July, 2011. Greenbone Networks GmbH kindly hosts the developer conference at their offices:
Neuer Graben 17
49074 Osnabrück
Germany

Anyone being active as OpenVAS developer, tester, packager or user is welcome. Check out official devcon page. You can also still submit lightning talks, more info here.

OpenVAS Administrator 1.0.1 released

2011-01-17T23:53:00.000Z

The OpenVAS developers are happy to announce the first maintenance release for the 1.0 series of the Administrator module for the Open Vulnerability Assessment System (OpenVAS).

It improves LDAP-based authentication and adds self-documentation feature for the OpenVAS Administration Protocol (OAP) 1.0.

Many thanks to everyone who has contributed to this release: Matthew Mundell, Michael Wiegand, Jan-Oliver Wagner and Felix Wolfsteller.

Main changes since 1.0.0:
* Fixed behaviour for ldap-based authentication for Admin role.
* Added protocol documentation for OAP (html and rnc format,
can be build with "make doc").
* Code hardening at compile time is now the default.
* Harmonized output of "--version" with other modules.

The source tarball for this release is available for download from the OpenVAS website at http://www.openvas.org/. Binary packages for major GNU/Linux distributions by third parties are expected in the following weeks.

openvas-libraries 3.1.4 released

2010-10-31T09:49:00.000Z

The OpenVAS developers are happy to announce the release of openvas-libraries 3.1.4. This release includes the results of further code analysis and cleanup, which resulted in the removal of more than 3,500 lines of unused code. It also includes a fix for a memory management issue and for superfluous log messages.

Many thanks to everyone who has contributed to this release: Matthew Mundell, Jan-Oliver Wagner and Michael Wiegand.

Main changes compared to 3.1.3:
* Further code cleanup has lead to the removal of more than 3,500 lines of
unused code.
* A bug which tried to free memory that was not allocated before under some
circumstances has been fixed.
* Superfluous log messages regarding file uploads have been removed.

The source tarball for this release is available for download from the OpenVAS website at http://www.openvas.org/. Binary packages for major GNU/Linux distributions by third parties are expected in the following weeks.

openvas-cli 1.0.1 released

2010-10-31T09:48:00.002Z

The OpenVAS developers are happy to announce the release of openvas-cli 1.0.1. This release improves the handling of special characters in OMP commands.

Many thanks to everyone who has contributed to this release: Matthew Mundell, Michael Wiegand and Felix Wolfsteller.

Main changes compared to 1.0.0:
* Special characters in OMP commands (like umlauts) are now handled correctly.
* The documentation has been improved; source code documentation can now be
generated using the "make doc" and "make doc-full" commands.

The source tarball for this release is available for download from the OpenVAS website at http://www.openvas.org/. Binary packages for major GNU/Linux distributions by third parties are expected in the following weeks.

openvas-manager 1.0.3 released

2010-10-31T09:47:00.003Z

The OpenVAS developers are happy to announce the release of openvas-manager 1.0.3. This release is the third maintenance release for the 1.0 series of the openvas-manager module for the Open Vulnerability Assessment System (OpenVAS).

It fixes two bugs which caused to manager to fail to reply properly on certain request and improves the PDF report generation.

Many thanks to everyone who has contributed to this release: Matthew Mundell and Michael Wiegand.

Main changes since 1.0.2:
* Two bugs which caused the manager to fail to give adequate replies on
certain
report and scan config requests have been fixed.
* A bug which caused PDF reports to be unavailable for reports which contained
certain unicode character has been fixed.

The source tarball for this release is available for download from the OpenVAS website at http://www.openvas.org/. Binary packages for major GNU/Linux distributions by third parties are expected in the following weeks.

gsa 1.0.3 released

2010-10-31T09:47:00.000Z

The OpenVAS developers are happy to announce the release of gsa 1.0.3. This is the third maintenance release for the 1.0 series of GSA (Greenbone Security Assistant), an OMP web client for the Open Vulnerability Assessment System (OpenVAS).

It addresses a number of issues in the user interface and improves stability during XSL transformations. GSA now builds with the latest libmicrohttpd release (0.9.2) as well.

Many thanks to everyone who has contributed to this release: Matthew Mundell, Jan-Oliver Wagner and Michael Wiegand.

Main changes since 1.0.2:
* When creating new credentials, password authentication is now the default.
* A bug which caused the "Pause" button not to work under certain
circumstances has been fixed.
* The handling of errors during the XSL transformation has been improved.
* The handling of long lines in the XSL transformation has been improved.
* The range of characters allowed for LSC passwords has been extended.
* An issue which prevented gsa from building with libmicrohttpd 0.9.2 has been
fixed.

The source tarball for this release is available for download from the OpenVAS website at http://www.openvas.org/. Binary packages for major GNU/Linux distributions by third parties are expected in the following weeks.

openvas-libraries 3.1.3 released

2010-09-10T08:23:00.002+01:00

The OpenVAS developers are happy to announce the release of openvas-libraries 3.1.3.

It fixes primarily a significant memory leak that will improve high load performance by about 40%.

This release is recommended for anyone using OpenVAS for large scans to improve performance.

Many thanks to everyone who has contributed to this release: Chandrashekhar B, Matthew Mundell, Thomas Reinke(the memory leak fixes), Michael Wiegand.

Main changes compared to 3.1.1:
* Significant memory leaks are closed.
* Bug fix for handling shared file descriptors that now prevents unnecessary use of new file descriptors under certain circumstances.
* Little fix in the nasl wmi api.

The source tarball for this release is available for download from the OpenVAS website at http://www.openvas.org/. Binary packages for major GNU/Linux distributions by third parties are expected to follow

GSA Desktop 0.3.0 released

2010-09-08T15:31:00.000+01:00

The development of the OMP 1.0 desktop client continues and it is called GSA Desktop.

The new version 0.3.0 introduces details dialogs for tasks and scan configurations. It adds the feature to display and save system reports.

The Windows version looks much nicer regarding the progress bars.

Installer for Windows is available in the download section as well.
http://wald.intevation.org/frs/download.php/780/GSA-Desktop-0.3.0-1.exe

Remind: This is still work-in-progress. GSA Desktop 0.3.0 misses some core functionality: Scan Config read/edit and Report details.However, it is usuable seemless in parallel with GSA or other OMP clients.

Full language support for: English, German.

Thanks to Raimund Renkert for the work on this module! Go and get it at www.openvas.org.

gsa 1.0.2 released

2010-08-17T23:00:00.002+01:00

The OpenVAS developers are happy to announce the release of gsa 1.0.2. This is the second maintenance release for the 1.0 series of GSA (Greenbone Security Assistant), an OMP web client for the Open Vulnerability Assessment System (OpenVAS).

It fixes an issue which caused users using Microsoft Internet Explorer to be unable to access individual NVT families from the "Edit Network Vulnerability Test Families" page.

Many thanks to everyone who has contributed to this release: Matthew Mundell and Michael Wiegand.

Main changes since 1.0.1:
* An issue which caused NVT family to be improperly submitted when using Microsoft Internet Explorer to edit NVT families has been fixed.

The source tarball for this release is available for download from the OpenVAS website at http://www.openvas.org/. Binary packages for major GNU/Linux distributions by third parties are expected in the following weeks.

openvas-manager 1.0.2 released

2010-08-17T22:57:00.001+01:00

The OpenVAS developers are happy to announce the release of openvas-manager 1.0.2. This is the second maintenance release for the 1.0 series of the openvas-manager module for the Open Vulnerability Assessment System (OpenVAS).

It fixes a bug which could cause changes in derived scan configs to affect predefined scan configs under certain circumstances.

Many thanks to everyone who has contributed to this release:
Matthew Mundell and Michael Wiegand.

Main changes since 1.0.1:
* A bug which could cause changes in derived scan configs to affect predefined
scan configs under certain circumstances has been fixed.

The source tarball for this release is available for download from the OpenVAS website at http://www.openvas.org/. Binary packages for major GNU/Linux distributions by third parties are expected in the following weeks.

openvas-libraries 3.1.2 released

2010-08-05T00:26:00.001+01:00

The OpenVAS developers are happy to announce the release of openvas-libraries
3.1.2. This release fixes a build issue that was discovered after the release
of openvas-libraries 3.1.1.

Many thanks to everyone who has contributed to this release:
Michael Wiegand.

Main changes compared to 3.1.1:
* A bug in the WMI interface stub which caused the build to fail when
configured without WMI has been fixed.

The source tarball for this release is available for download from the OpenVAS
website at http://www.openvas.org/. Binary packages for major GNU/Linux
distributions by third parties are expected in the following weeks.

Command line client 1.0.0 released

2010-08-05T00:25:00.002+01:00

OpenVAS CLI 1.0: Full command line client for OpenVAS Manager 1.0 now available

The OpenVAS CLI package contains the command line tool "omp" which allows to send any
command of the OpenVAS Management Protocol (OMP) in original form and some of
the commands as short cuts. This allows to create batch processes for remote
control of OpenVAS.

OpenVAS CLI is Free Software (Open Source), licensed
under GNU General Public License Version 2 or any later version.

The OpenVAS development team offers support for any efforts to create binary
packages for the various Linux distributions in order have this new tool
readily available for users as soon as possible. Please use our openvas-distro
mailing list for this purpose.

Web-Client GSA 1.0.0 released

2010-08-05T00:25:00.001+01:00

Greenbone Security Assistant (GSA) 1.0: Full web-client for OpenVAS Manager 1.0 now available

GSA 1.0 represents almost 2 years of intensive work. The mission of GSA is to be
a web client to the OpenVAS Manager 1.0 via the OpenVAS Management Protocol (OMP).

GSA offers a complete implementation of OMP in order to access all features
to organize and manage OpenVAS vulnerability scans. Additionally, GSA
optionally acts as a client for the upcoming openvas-administrator using the
OpenVAS Administration Protocol (OAP) which allows e.g. management of scan users.

Central features of Greenbone Security Assistant are:

* Full OMP 1.0 client. The XML-based OMP responses are transformed into
web pages via XSLT.

* No additional web-server required. The GSA daemon (gsad) uses microhttpd
to implement a HTTP service on its own.

* Plain HTML. Neither cookies, JavaScript nor other dynamic elements are used.
GSA works stateless and uses HTTP Basic Auth.

Greenbone Security Assistant is Free Software (Open Source), licensed
under GNU General Public License Version 2 or any later version.

The OpenVAS development team offers support for any efforts to create binary
packages for the various Linux distributions in order have this new server
readily available for users as soon as possible. Please use our openvas-distro
mailing list for this purpose.

gsa-desktop 0.1.0 released

2010-07-29T15:20:00.000+01:00

Those of you watching the SVN commits and the OpenVAS website closely will
already have noticed it: Our newest OpenVAS module just had it's first
release.

The newest member of the OpenVAS family is called gsa-desktop and is a Qt
based OMP client with the ultimate goal of providing an alternative to the
Gtk based OpenVAS-Client while offering the full potential of OMP.

We invite you to try out gsa-desktop and are looking forward to your feedback.

Please keep in mind that gsa-desktop is still in an early stage and does not
yet cover all the functionality provided by OMP. Please read the INSTALL and
README files provided and feel free to ask on the OpenVAS mailing lists if
you have questions.

OpenVAS Manager 1.0 released

2010-07-29T14:44:00.000+01:00

Substantial Technology Adance: Vulnerability Management with OpenVAS Manager 1.0

OpenVAS Manager 1.0 represents almost 2 years of intensive work. The mission of
OpenVAS Manager is to offer powerful and comfortable vulnerability management on
top of the actual vulnerability scanner, OpenVAS Scanner 3.1.

The OpenVAS Manager is a layer between the OpenVAS Scanner and various client
applications. The upcoming clients cover web, desktop and command line
technology and will replace the classic OpenVAS Client.

Central features of OpenVAS Manager are:

* New XML-based protocol OMP (OpenVAS Management Protocol) which client tools
use to control scans, results, etc.

* SQL database where configurations, scan results etc. are stored. Thus, clients
do not need to keep local storage anymore.

* Full control of scan processes. This includes multiple concurrent scans as
well as stopping, pausing, resuming and not at least the scheduling of scans.

* Management of scan notes, false positives and result escalators (notification
on finished scans).

OpenVAS Manager is Free Software (Open Source), licensed under GNU General
Public License Version 2 or any later version.

The first compatible client application to be released will be the web client
GSA (Greenbone Security Assistant), approximately next week.
Beta- and alpha versions of various clients are already available for download.

The OpenVAS development team offers support for any efforts to create binary
packages for the various Linux distributions in order have this new server
readily available for users as soon as possible. Please use our openvas-distro
mailing list for this purpose.

OpenVAS libraries and scanner 3.1.0 release

2010-07-29T14:42:00.001+01:00

OpenVAS libraries

The OpenVAS developers are happy to announce the release of openvas-libraries
3.1.0. This release adds a number of new features, for example support for
NTLMSSP, for LDAP authentication, for preference file uploads to memory, for
logging messages to syslog and for scanning virtual web hosts.

Many thanks to everyone who has contributed to this release:
Tim Brown, Geoff Galitz, Stephan Kleine, Goran Licina, Michael Meyer, Matthew
Mundell, Raimund Renkert, Preeti Subramanian, Jan-Oliver Wagner, Michael
Wiegand and Felix Wolfsteller.

Main changes compared to 3.0.5:
* Code cleanup: Code from openvas-administrator and openvas-manager which
could be more appropriately placed in openvas-libraries has been moved here.
* Initial support for LDAP authentication has been added.
* IPv6 support has been improved.
* Support for building parts of openvas-libraries on Windows has been added.
* Support for reading preference file uploads from memory instead of from disk
has been added.
* Support for NTLMSSP has been added.
* Authentication mechanism extended to support LDAP and ADS.
* An issue which caused SSH logins with RSA keys on remote systems to fail
under certain circumstances has been fixed.
* Support for logging to syslog has been added.
* Support for scanning virtual web hosts has been added.

The source tarball for this release is available for download from the OpenVAS
website at http://www.openvas.org/. Binary packages for major GNU/Linux
distributions by third parties are expected in the following weeks.

OpenVAS scanner

The OpenVAS developers are happy to announce the release of openvas-scanner
3.1.0. This release adds a number of new features, for example support for
soft pausing of scans, for retrieving the version of an installed NVT
collection, for automatically installing generated client certificates, for
storing uploaded preference files in memory, for dropping privileges for NASL
and NES NVTs and for scanning virtual web hosts. It also contains updated
feed synchronization scripts and removes legacy support for passwords stored
in plaintext (see OpenVAS change request #31,
http://www.openvas.org/openvas-cr-31.html).

Many thanks to everyone who has contributed to this release:
Geoff Galitz, Michael Meyer, Matthew Mundell, Jan-Oliver Wagner, Michael
Wiegand and Felix Wolfsteller.

Main changes compared to 3.0.2:
* Support for storing scanner passwords in plaintext has been removed.
* Support for dropping privileges in NASL and NES NVTs had been added.
* Support for scanning virtual web hosts has been added.
* The handling of NVTs with an invalid timestamp has been improved.
* A bug in the openvas-nvt-sync script which prevented synchronization via
http under certain circumstances has been fixed.
* Support for retrieving the version of the NVT collection has been added to
the openvas-nvt-sync and greenbone-nvt-sync scripts.
* Support for soft pausing of scans has been added.
* Support for automatically installing generated certificate file has been
added to the openvas-mkcert-client script.
* The obsolete C based NVT "ssl_cipher" has been removed from the
openvas-scanner module. It has been replaced by the NASL
implementation "secpod_ssl_ciphers.nasl".
* Support for storing an uploaded preference file in memory instead of on disk
has been added.

The source tarball for this release is available for download from the OpenVAS
website at http://www.openvas.org/. Binary packages for major GNU/Linux
distributions by third parties are expected in the following weeks.

New OpenVAS 3.1 Release Candidates(rc2) released

2010-06-30T22:38:00.002+01:00

The OpenVAS developers are happy to announce the release of the second set of release candidates for the upcoming 3.1.0 release of both openvas-scanner and openvas-libraries.

Changes compared to the 3.0.x version include NTLMSSP support, improved IPv6 support, support for uploading preference file into memory and for soft pausing of scans. The latest set of release candidates adds support for LDAP and ADS authentication, scanning virtual web hosts, syslog logging and privilege dropping among other improvements and fixes. For more information please check the CHANGES file provided with each module.

Source tarballs for the two modules are available at
http://wald.intevation.org/frs/download.php/749/openvas-libraries-3.1.0.rc2.tar.gz
and
http://wald.intevation.org/frs/download.php/750/openvas-scanner-3.1.0.rc2.tar.gz

Binary packages for the major GNU/Linux distributions by third parties are expected in the following weeks.

Many thanks to everybody who has made this release possible.

Building latest (stable) OpenVAS

2010-05-23T10:15:00.008+01:00

In case you're tired of building latest versions of OpenVAS when each new (stable) release comes out, there is nice script on OpenVAS trunk which can help you in building OpenVAS (once you satisfy dependencies).

It is located in trunk/tools directory on Subversion, but if you don't like to use Subversion just to grab this script, you can look up build-openvas-3-x.sh script on the web or download latest version of build-openvas-3-x.sh directly.

How to proceed with the build? Very simple! Just say something like this:

SUDOCMD="sudo" sh build-openvas-3-x.sh

Script will automatically download latest version, build it and install it to /opt/openvas-current-date (for example: /opt/openvas-2010-05-23).

There is also other options which you can pass as environment variable to the script, but you can look it up in the script source (there is some examples in the comment section). For the sake of completeness, here are few examples:

SUDOCMD="sudo" sh build-openvas-3-x.sh
OVNOCLI="yes" sh build-openvas-3-x.sh
OPENVASPATH="/opt/openvas-3" sh build-openvas-3-x.sh
OVSKIPLATEST="yes" sh build-openvas-3-x.sh
OVSKIPRM="yes" sh build-openvas-3-x.sh
OVSKIPBUILD="yes" sh build-openvas-3-x.sh
OVSKIPRM="yes" OVSKIPBUILD="yes" sh build-openvas-3-x.sh

Have a pleasant scanning with the OpenVAS! :)

OpenVAS LiveCD/Virtual machine - version 1.0

2010-05-21T11:10:00.001+01:00

Trying out OpenVAS can be as easy as starting a VM image or a Live-CD.

Two versions are available: OpenVAS Server providing just the scan engine framework to be used via a browser or OpenVAS Management Protocol (OMP) clients. And OpenVAS Desktop which adds a desktop to the server including the OMP clients and immediately offers a graphical user interface to OpenVAS after booting.

Please note that both, OpenVAS Server and OpenVAS Desktop, are for demonstration and are not recommended for regular production uses, particularly for more than a few hosts depending on local system resources. The OpenVAS scanner is resource intensive and may take a long time to start on slower systems, especially when run as a VM on laptops.
Login credentials are dynamically generated on firstboot of the appliance and are specified at the console.

Tested with: VirtualBox 3.x, VMWare Workstation 6.5 and XenServer 5.5.0.

For more information go to: http://openvas.org/vm.html

OpenVAS 3.1.0rc1 released

2010-05-21T11:09:00.002+01:00

The OpenVAS developers are happy to announce the release of the first release
candidates for the upcoming 3.1.0 release of both openvas-scanner and
openvas-libraries.

Changes compared to the 3.0.x version include NTLMSSP support, improved IPv6
support, support for uploading preference file into memory and for soft
pausing of scans. For more information please check the CHANGES file provided
with each module.

Source tarballs for the two modules are available at
http://wald.intevation.org/frs/download.php/737/openvas-libraries-3.1.0.rc1.tar.gz
and
http://wald.intevation.org/frs/download.php/738/openvas-scanner-3.1.0.rc1.tar.gz

Binary packages for the major GNU/Linux distributions by third parties are
expected in the following weeks.

Many thanks to everybody who has made this release possible.

gsa 1.0.0-beta6 released

2010-04-15T15:48:00.001+01:00

This is the sixth beta release of the optional Greenbone Security Assistant(gsa) module for the Open Vulnerability Assessment System (OpenVAS) leading up to the upcoming gsa 1.0.

Many thanks to everyone who has contributed to this release:
Stephan Kleine, Matthew Mundell, Mareike Piechowiak, Karl-Heinz Ruskowski, Jan-Oliver Wagner and Michael Wiegand.

Main changes since 1.0.0-beta5:

* Support for ITG and CPE reports has been improved.
* Support for resuming stopped tasks has been added.
* Support for task scheduling has been added.
* Initial support for editing tasks has been added.
* Support for displaying the version of an installed feed has been added.
* A number of build issues have been fixed.
* The documentation available via the "?" icon has been updated.
* The gsad binary is now installed to /usr/sbin instead of /usr/bin.

openvas-manager 1.0.0-beta6 released

2010-04-15T15:46:00.002+01:00

This is the sixth beta release of the openvas-manager module for the Open Vulnerability Assessment System (OpenVAS) leading up to the upcoming openvas-manager 1.0.

IMPORTANT: The manager now uses certificate based authentication to authenticate against an openvas-scanner. Please do read the INSTALL file provided with openvas manager and make sure you have openvas-scanner 3.0.2 or higher before installing this manager version!

Many thanks to everyone who has contributed to this release:
Hartmut Goebel, Stephan Kleine, Matthew Mundell, Joseph Sokol-Margolis, Jan-Oliver Wagner, Michael Wiegand and Felix Wolfsteller.

openvas-libraries 3.0.5 released

2010-04-13T10:58:00.001+01:00

This is the fifth maintenance release of the openvas-libraries module for the Open Vulnerability Assessment System (OpenVAS) 3.0 series.

It contains support for resuming tasks, improved packet forgery support for IPv6 environments and a reworked internal build infrastructure.

Many thanks to everyone who has contributed to this release: Tim Brown, Stephan Kleine, Vlatko Kosturjak, Matthew Mundell, Mareike Piechowiak, Preeti Subramanian, Jan-Oliver Wagner, Michael Wiegand and Felix Wolfsteller.

Main changes compared to 3.0.4:

* The build infrastructure for the hg and misc modules has been switch to CMake
from autoconf.
* Support for resuming tasks has been added to OMP.
* Packet forgery support for IPv6 has been improved.
* A build issue on Mandriva has been fixed.

Started OpenVAS blog

2009-10-19T08:18:00.000+01:00

This is first post - just for test. Hopefully, we will write more.