great news! Can you share the plugin set version number where these improvements will be included?

@Greg Betz​ Can you clarify the statement "This is limited to a depth of one level due to performance issues"? Is this true even with Thorough scans enabled?

All of these changes except those mentioned under the Target Release Date are included in Nessus plugin feed 202112220551. I'll update this post once the additional improvements to 156000 and 156001 are released.

@Greg Betz​ Thanks for the clarification! Appreciate the quick reply.

@Greg Betz​ ,

I have a question: if the search is using 'locate' vs. 'find,' Does the plugin issue the updatedb before the plugin fires? If not, locate will only use the file database to do the search from the last time updatedb is run.

Bobby

@Greg Betz​ Have the updates been published for these plugins? Specifically, will the standard scans now be able to detect the vulnerability on Windows devices without the need for explicit thorough checks using the Log4Shell template?

Thanks!

Improvements for Apache Log4j JAR Detection (Windows) (156001) have been released in Nessus plugin feed 202112230037

Note: the check for JndiLookup.class in Windows has not been released and another update will go out once that check is added.

Hi Team,

There is log4j vulnerability in Windows 2012 Servers, however, still the Nessus not detecting the log4j file reporting as vulnerable.

I understand the plugins would be updated day by day to improve the detections, However, customers are expecting that if we have the Nessus scanner it will detect the vulnerability and report it.

As a Security engineer we have challenges to keep justify about our Nessus tool capability, how the plugins developed , pushed and detect the vulnerability.

Did we set wrong expectations to the customers about the Nessus scanner or Customer is not understanding about the way of working?

How could we solve these challenges ? I am trying my nest to explain and justify that its not a tool issue and the developer would have challenges to receive the updates from multiple vendor and push the signatures once they have a clear solution in place to detect the vulnerability.

However, the vendor would report to the system owners before vulnerability scanner identify then the customer / CISO started to ask why our scanner doesn't have feasibility to detect the vulnerability?

If the experts could share some inputs / your experience it will be much appreciated !!

Thanks

Venkatesh Poyyalisamy

BFB Security has identified a possible issue that will obfuscate or miss some embedded jar versions of log4j. We are working with development to update the detection process, check back for updates.

The remaining improvements mentioned in this Release Highlight have been released in Nessus plugin feed 202112280531

Please note that we are working on additional improvements and have been rolling them out in a phased approach which allows us to build upon previous improvements while being cautious about regression issues. The changes that are made to these detection plugins needs to be carefully considered, implemented, and tested since they need to fit alongside many other plugins in different scan configurations without causing issues, unlike tools specifically made for Log4j.

Please open a technical support ticket if you are having issues so that we can collect the required information to diagnosis the issue.