[joergsauer]

This looks interesting. I have been looking for a solution to this problem without any clear conclusions so far. Nessus and Qualys have new agent-based scanners now, but I have not tested them because they both only support Red Hat-based Linux distros.

It sounds like for most software you are using the Ubuntu package management system to check for vulnerable versions. Is that correct? And are you planning to add detection for binaries that live outside of the distro package manager? I am thinking of stuff like custom-compiled Nginx binaries for example. I realize it would be non-trivial to implement this but would consider it highly useful at least for a certain set of common software components.

[phillmv]

>And are you planning to add detection for binaries that live outside of the distro package manager?

It's on the roadmap! Others have mentioned that before. First we need to get really good at knowing about CVEs :).

[feld]

If you can solve this people will throw boatloads of money at you.

Unfortunately it's not easy -- even writing scripts to detect running processes across all our servers to identify Java, Apache, Tomcat, etc etc has proven difficult to get right. Sometimes you can get enough info from extended process list info, sometimes not.

Sucks.