Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm looking for a database with all the noteworthy unix programs with a timeline of vulnerabilities found in that individual product in some categories (remote/local, DoS, privilege elevation, data execution), and and average, how often these things happen in a yearly basis of each individual product.

share|improve this question

closed as not constructive by Shane Madden, John Gardeniers, HopelessN00b, voretaq7 Nov 15 '12 at 6:35

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

    
You might like to describe what you're trying to achieve, rather than bring us in halfway through your problem solving train of thought. –  womble Jul 17 '11 at 10:07
    
I'm trying to take an objective look at the security of my system. Instead of blurry views of some individuals, I want to base my evaluation on solid facts. If I have a range of possible products (firewalls for example), I want to see 4 numbers next to each product, which poses more risk. - And the same thing between different kinds of software. I want to answer questions like: is my ftp server more secure than my webserver? –  vbence Jul 17 '11 at 10:48
    
Good luck with that little project. The upside is that you'll have wonderfully secure systems, because you'll never get time to actually set anything up... <grin> –  womble Jul 17 '11 at 11:53
    
So... why the -1? –  vbence Jul 19 '11 at 16:38
add comment

2 Answers 2

Something like http://cve.mitre.org/ ?

share|improve this answer
    
Thanks. I see this as a vulnerability archive. Is there any way to query this database in some way similar to what I described? (Average vulnerabilities found / year for different types). –  vbence Jul 17 '11 at 10:51
    
Yep, download the CVE list and go to town. –  womble Jul 17 '11 at 11:54
    
Thanks, I've downloaded the CSV verson, the problem is that it is not properly tagged. Text searching is not an option, just because a product's name is present in the description it soes not neccesarily mean that the given product is vulnerable. Also no means to check the severity of each vulnerability. –  vbence Jul 17 '11 at 12:10
    
@vbence - it is the closest thing industry has. You could write a more appropriate search analysis function; I think a lot of folks would thank you for it :-) –  Rory Alsop Jul 18 '11 at 14:51
add comment
up vote 1 down vote accepted

It seems like Portaudit has the best indexed list this far. It is tagged with one of the two pieces of information I need: you can identify which package (product) has the vulnerability.

It has no information about the severity, or at least I could not find it this far.

http://www.freebsd.org/doc/handbook/security-portaudit.html

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.