Homework: Vulnerability Scanner
You will be using your virtual machine from last week and installing, configuring, and then running a vulnerability scanner to scan your virtual machine.
You will be using a free open-source scanner named Vuls. To help you get it installed and running, you can follow these instructions, which recommend that you use an account named "Sammy." I did these instructions using my root account and ignored the Sammy parts. (Admittedly, this is poor practice, but for a virtual machine we are deleting at the end of the course, we can bend the rules of best practices a bit.) Follow steps 1 through 6.
o How to Use Vuls as a Vulnerability Scanner on Ubuntu 18.04.
In our instructions for the week, we need to edit a couple commands along the way. This is due to the author of the utilities changing the
way that certain command arguments are processed. The functionality still works but the commands will differ. Please make sure you use these modifications in order to not have errors. Again, copy/paste will be the easiest way to capture the changes so you don't miss a dash or space.
ORIGINAL: for i in `seq 2002 $(date +"%Y")`; do sudo go-cve-dictionary fetchnvd -dbpath /usr/share/vuls-data/cve.sqlite3 -years $i; done
CHANGE: sudo go-cve-dictionary fetch nvd --dbpath /usr/share/vuls-data/cve.sqlite3
ORIGINAL: sudo goval-dictionary fetch-ubuntu -dbpath=/usr/share/vuls-data/oval.sqlite3 18
CHANGE: sudo goval-dictionary fetch ubuntu --dbpath=/usr/share/vuls-data/oval.sqlite3 18
At the conclusion of Step 6, you will have run the scanner against your virtual machine. There will be vulnerabilities, many of which will be unpatchable. Attach a screenshot to your submission of your results screen. Pick one of the vulnerabilities and answer the following questions:
i. What is the CVE number of your chosen vulnerability?
ii. What year was this CVE discovered? (Hint: this is part of the CVE number!)
iii. What software programs are affected?
iv. In your own words, what is the summary of this vulnerability?
v. Perform an analysis of the likelihood of this vulnerability being exploited. In other words, would this program's vulnerability be easily exposed to an attacker or would it require a complex scenario to make this exposed?
vi. In your opinion, given the CVE criticality and the likelihood, do you feel comfortable with this vulnerable software on your system?
Format your homework according to the following formatting requirements:
i) The answer should be typed, using Times New Roman font (size 12), double spaced, with one-inch margins on all sides.
ii) The response also includes a cover page containing the title of the homework, the student's name, the course title, and the date. The cover page is not included in the required page length.
iii) Also include a reference page. The Citations and references must follow APA format. The reference page is not included in the required page length.