2

I'm looking for some specific aggregated data: what I want is a 2-column table with the port number (0 to 65535) as first column, and as second column, the sum over the total number of vulnerabilities (bugs that permit remote access or dos) related to each application that run every sevice.

Example:

Tab1

port applications
21   proFTP 
80   apache,ngx,IIS
25   qmail,sendmail

Tab2

app      n° of vuln
IIS      9
nginx    2
proFTP   6
apache   4
qmail    1
sendmail 6
sshd-3
ftpd-4

And we get as final data:

Tab3

port  total vuln
21    6+4
80    2+4+9
25    6+1
22    3

Since I could not find this data, I'm thinking to create this table on my own. That's the procedure I was thinking about:

  1. Find the default services for each port (easy)
  2. Find the complete list of all cve in a structured format (easy)
  3. "Grep" all the software name from 2 and group the vuln by service name
  4. Match the services offered by each application from cve (if any)
  5. Group vuln by services/port and create the table.

If you already have some intermediate data (Tab1 or Tab2) It would be very helpful.

Improve this question
6
  • #2's going to change w/ time, as patches become available. #1's going to be fairly large, as some services just have a lot of implementations available (eg, FTP) ... and you also have services that use more than one port (eg, FTP), and packages that provide more than one service (eg, a mail server might provide POP3, POP3S, IMAP, IMAPS, SMTP & ASMTP)
    – Joe
    Nov 26, 2013 at 21:02
  • 1
    No. 2 also is a very ill-defined metric that has many components (as you note: bugs, typical strength of user passwds, ...) that have no straightforward way of being summed. Now that I type: what is the underlying question you want to answer?
    – ojdo
    Nov 26, 2013 at 22:44
  • I'm asking if someone has already this kind of data or can help me obtaining it. @Joe I know it's gonna change over time, but i need this data just in a precise time. I'm gonna release the sources for recreating data. Services with multiple port aren't gonna be a problem: they'll appear multiple times.
    – asdf
    Nov 27, 2013 at 0:24
  • 1
    @ojdo : and don't forget that it's prone to over-counting in cases where software's forked, or reliant on the same library. (if there's a flaw in zlib that can be exploited, does it count as 0 (zlib isn't a service on its own), or for every service that uses zlib? Or only those where the library is used such that the vulnerability is remote exploitable?
    – Joe
    Nov 27, 2013 at 1:40
  • Alessandro, the problem is that in some communities 'data' means more than just a collection of values ... it's something that can be used as evidence for an argument, and so as I see it, issues with methodology behind the values affect if it is or isn't data. You might want to explain what you're trying to do on one of the various CVE mailing lists, and get some peer review of your concept. As a sysadmin for the last ~15 years, what you're describing just sounds like something that has no use other than the security gestapo complain because I'm listening on a port they don't like.
    – Joe
    Nov 27, 2013 at 1:46

1 Answer 1

Reset to default
2

OpenVAS have a really good repository for "Network Vulnerability Tests" that contain all the information needed to carry a research like this.

Downloading the archive from the nvts repository you can parse the file in the database,and make your own statistic of port sorted according vulnerability. With a few bash lines of code you can filter all the files that contain at least one "CVE-XXXX-XXXX" and one "port" directive, make some research inside the filtered files (warning: there can be more than one CVE and more than one port per file) and then sort and filter the results.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.