New Nessus Feature: Public Exploit Availability

A new feature was introduced with the latest update to the Nessus web server (2.0.0) and Flash interface (build 20100913A) to provide "exploitability" information to the user. Each plugin now contains a field that indicates whether or not a publicly-known exploit for the vulnerability exists:

The value will either be "True" if an exploit exists or "False" if an exploit is not publicly known. Nessus checks select sources for the presence of an exploit and updates this field accordingly. I purposely chose a "Medium" level vulnerability for this example, as exploits do not only have to be associated with “High” level alerts. In the above case, the vulnerability is a denial of service condition for NTP (Network Time Protocol), which just happens to have an exploit publicly available.

This update also includes additional logic to support CVSS temporal scoring, a means to lower the CVSS score based on confirmation of the technical details, the remediation status, and availability of an exploit. For example, if someone posted a new remote exploit for Windows 7, then it would receive a CVSS score of 10. However, since the vendor has not confirmed it and no exploit exists publicly, then the score could be adjusted with the temporal scoring method. The CVSS Temporal also score takes into account if a proof of concept exists (but is not "weaponized") or an exploit has been published and works well for every configuration.

A new checkbox has been added to the filtering feature within the Nessus web interface. When checked, it will only list vulnerabilities that Nessus reported a public exploit for:

This is a great feature that will add more context to the vulnerabilities discovered in your network to better evaluate risk. Nessus ProfessionalFeed and HomeFeed users just need to perform a plugin update to add this feature.