|
|
On December 17th, 2008, the OpenVAS developer team released OpenVAS 2.0.0 which marks the start of the next generation of the Open Vulnerability Assessment System for network security scanning.
|
|
On December 17th, 2008, the OpenVAS developer team released OpenVAS 2.0.0
which marks the start of the next generation of the Open Vulnerability
Assessment System for network security scanning.
OpenVAS is a fork of the Nessus security scanner which has continued development
under a proprietary license since late 2005. Since the release of OpenVAS 1.0.0
in October 2007, the OpenVAS developers continued the auditing of the code
inherited from Nessus and have added a variety of useful features for OpenVAS
users, for server administrators and for developers of Network Vulnerability
Tests (NVTs).
The main changes compared to the 1.0 series cover:
- Initial OVAL Support:
OpenVAS 2.0.0 introduces preliminary support for OVAL, the Open Vulnerability and Assessment Language.
OVAL is an international, information security, community standard to promote
open, standardized and publicly available security content. The OpenVAS
server can now execute OVAL files just like its own Network Vulnerability
Tests (NVTs) using the OVAL definitions interpreter "ovaldi". While the
plain ovaldi tool can only check local systems where it is installed, the
combination with OpenVAS enables ovaldi to test any target system for which
OpenVAS has collected information. OpenVAS 2.0.0 includes readily available
support for Red Hat Enterprise Linux security announcements as published in
OVAL format. OVAL support will expand to further platforms.
- OpenVAS Transfer Protocol (OTP):
A comprehensive audit of the Nessus Transfer Protocol (NTP) resulted in
numerous improvements and fixes and lead to the OpenVAS Transfer Protocol
(OTP). Since NTP support was dropped entirely, the 1.0 and 2.0 series of
OpenVAS Server and Client can not operate in mixed mode.
- Object Identifiers (OIDs):
In order to make identifying individual NVTs easier, OpenVAS adopted an
OID-based numbering scheme for NVTs. OIDs in OpenVAS will start with the
prefix 1.3.6.1.4.1.25623, backward compatibility in server and client has been
ensured.
- 64-bit Support:
Intensive work on 64-bit cleanliness has been undertaken. OpenVAS 2.0.0
is expected be fully 64-bit compatible.
- Improved GUI Client:
The OpenVAS-Client has seen a number of improvements and is now able to
display NVT signature information in the GUI and in the various reports.
Reporting has been improved as well as localization for various languages
(best support in this order: German, Spanish/French, Swedish, Hebrew,
Croatian).
- Bugfixes:
Any spotted bugs have been fixed. Please refer to
the CHANGES files supplied with the individual modules for details.
- Code Audit:
A large amount of outdated or unused code has been identified and removed or
replaced.
Compatibility of NASL NVTs and the OpenVAS Feed Service:
The available NVT package (openvas-plugins) and OpenVAS Feed which provides more
than 6000 NVTs are compatible for both the 1.0 and the 2.0 series of OpenVAS.
Migration from OpenVAS 1.0:
If you want to migrate your existing reports created with an 1.0 series client
to OpenVAS 2.0.0, please use the script provided in the openvas-client/tools
directory.
If you are currently using OpenVAS 1.0.x, we recommend that you install the
OpenVAS 2.0.0 source code release separately from your existing installation.
Documentation:
An extensive documentation for OpenVAS has been created as well and was recently
released. Users, administrators and developers can now access more than 100 pages
of the OpenVAS Compendium, available in English and German.
Downloads:
All download links for OpenVAS 2.0.0 and additional information can be found on
the OpenVAS website. OpenVAS 2.0.0 is initially released as a source code
release; packages for various distributions are expected to follow.
The OpenVAS team would like to thank everybody who has contributed to this
release. We have worked hard to bring you the best OpenVAS version. If you have
any questions or suggestions, please feel free to use the public mailing list
and our online chat. Please use the OpenVAS
bug tracker to report bugs.
The OpenVAS developers would like to wish all users a recreative holiday season
and a a happy new year.
Full Story |
