Apache Log4j Detection Improvements Summary: Since CVE-2021-4

Hi Team,

There is log4j vulnerability in Windows 2012 Servers, however, still the Nessus not detecting the log4j file reporting as vulnerable.

I understand the plugins would be updated day by day to improve the detections, However, customers are expecting that if we have the Nessus scanner it will detect the vulnerability and report it.

As a Security engineer we have challenges to keep justify about our Nessus tool capability, how the plugins developed , pushed and detect the vulnerability.

Did we set wrong expectations to the customers about the Nessus scanner or Customer is not understanding about the way of working?

How could we solve these challenges ? I am trying my nest to explain and justify that its not a tool issue and the developer would have challenges to receive the updates from multiple vendor and push the signatures once they have a clear solution in place to detect the vulnerability.

However, the vendor would report to the system owners before vulnerability scanner identify then the customer / CISO started to ask why our scanner doesn't have feasibility to detect the vulnerability?

If the experts could share some inputs / your experience it will be much appreciated !!

Thanks

Venkatesh Poyyalisamy