Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

I'm looking for a database with all the noteworthy unix programs with a timeline of vulnerabilities found in that individual product in some categories (remote/local, DoS, privilege elevation, data execution), and and average, how often these things happen in a yearly basis of each individual product.

share|improve this question
You might like to describe what you're trying to achieve, rather than bring us in halfway through your problem solving train of thought. – womble Jul 17 '11 at 10:07
I'm trying to take an objective look at the security of my system. Instead of blurry views of some individuals, I want to base my evaluation on solid facts. If I have a range of possible products (firewalls for example), I want to see 4 numbers next to each product, which poses more risk. - And the same thing between different kinds of software. I want to answer questions like: is my ftp server more secure than my webserver? – vbence Jul 17 '11 at 10:48
Good luck with that little project. The upside is that you'll have wonderfully secure systems, because you'll never get time to actually set anything up... <grin> – womble Jul 17 '11 at 11:53
So... why the -1? – vbence Jul 19 '11 at 16:38

closed as not constructive by Shane Madden, John Gardeniers, HopelessN00b, voretaq7♦ Nov 15 '12 at 6:35

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or specific expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, see the FAQ for guidance.

2 Answers

up vote 4 down vote

Something like http://cve.mitre.org/ ?

share|improve this answer
Thanks. I see this as a vulnerability archive. Is there any way to query this database in some way similar to what I described? (Average vulnerabilities found / year for different types). – vbence Jul 17 '11 at 10:51
Yep, download the CVE list and go to town. – womble Jul 17 '11 at 11:54
Thanks, I've downloaded the CSV verson, the problem is that it is not properly tagged. Text searching is not an option, just because a product's name is present in the description it soes not neccesarily mean that the given product is vulnerable. Also no means to check the severity of each vulnerability. – vbence Jul 17 '11 at 12:10
@vbence - it is the closest thing industry has. You could write a more appropriate search analysis function; I think a lot of folks would thank you for it :-) – Rory Alsop Jul 18 '11 at 14:51
up vote 1 down vote accepted

It seems like Portaudit has the best indexed list this far. It is tagged with one of the two pieces of information I need: you can identify which package (product) has the vulnerability.

It has no information about the severity, or at least I could not find it this far.

http://www.freebsd.org/doc/handbook/security-portaudit.html

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.