[Full-disclosure] Network Security Scanner OpenVAS 2.0.0 Released

Hello,

On December 17th, 2008, the OpenVAS[1] developer team released OpenVAS 2.0.0 which marks the start of the next generation of the Open Vulnerability Assessment System for network security scanning.

OpenVAS is a fork of the Nessus security scanner which has continued development under a proprietary license since late 2005. Since the release of OpenVAS 1.0.0 in October 2007, the OpenVAS developers continued the auditing of the code inherited from Nessus and have added a variety of useful features for OpenVAS users, for server adminstrators and for developers of Network Vulnerability Tests (NVTs).

The main changes compared to the 1.0 series cover:

• OVAL Support: OpenVAS 2.0.0 introduces preliminary support for OVAL, the Open Vulnerability and Assessment Language[2]. OVAL is an international, information security, community standard to promote open, standardized and publicly available security content. The OpenVAS server can now execute OVAL files just like its own Network Vulnerability Tests (NVTs) using the OVAL definitions interpreter "ovaldi". While the plain ovaldi tool can only check local systems where it is installed, the combination with OpenVAS enables ovaldi to test any target system for which OpenVAS has collected information. OpenVAS 2.0.0 includes readily available support for Red Hat Enterprise Linux security announcements as published in OVAL format. OVAL support will expand to further platforms.
• OpenVAS Transfer Protocol (OTP): A comprehensive audit of the Nessus Transfer Protocol (NTP) resulted in numerous improvements and fixes and lead to the OpenVAS Transfer Protocol (OTP). Since NTP support was dropped entirely, the 1.0 and 2.0 series of OpenVAS Server and Client can not operate in mixed mode.
• Object Identifiers (OIDs): In order to make identifying individual NVTs easier, OpenVAS adopted an OID-based numbering scheme for NVTs. OIDs in OpenVAS will start with the prefix 1.3.6.1.4.1.25623, backward compatibility in server and client has been ensured.
• 64-bit Support: Intensive work on 64-bit cleanliness has been undertaken. OpenVAS 2.0.0 is expected be fully 64-bit compatible.
• Improved GUI Client: The OpenVAS-Client has seen a number of improvements and is now able to display NVT signature information in the GUI and in the various reports. Reporting has been improved as well as localization for various languages (best support in this order: German, Spanish/French, Swedish, Hebrew, Croatian).
• Bugfixes: Any spotted bugs have been fixed. Please refer to the CHANGES files supplied with the individual modules for details.
• Code Audit: A large amount of outdated or unused code has been idenfied and removed or replaced.

Compatibility of NASL NVTs and the OpenVAS Feed Service: The available NVT package (openvas-plugins) and OpenVAS Feed which provides more than 6000 NVTs are compatible for both the 1.0 and the 2.0 series of OpenVAS.

Migration from OpenVAS 1.0:
If you want to migrate your existing reports created with an 1.0 series client to OpenVAS 2.0.0, please use the script provided in the openvas-client/tools directory.
If you are currently using OpenVAS 1.0.x, we recommend that you install the OpenVAS 2.0.0 source code relase seperately from your existing installation.

Documentation:
An extensive documentation for OpenVAS has been created as well and was recently released. Users, adminstrators and developers can now access more than 100 pages of the OpenVAS Compendium, available in English and German.

Downloads:
All download links for OpenVAS 2.0.0 and additional information can be found on the OpenVAS website[1]. OpenVAS 2.0.0 is initially relased as a source code release; packages for various distributions are expected to follow.

The OpenVAS team would like to thank everybody who has contributed to this release. We have worked hard to bring you the best OpenVAS version. If you have any questions or suggestions, please feel free to use the public mailing list and our online chat. Please use the OpenVAS bug tracker[3] to report bugs.

The OpenVAS developers would like to wish all users a recreative holiday season and a a happy new year. [1] http://www.openvas.org [2] http://oval.mitre.org [3] http://bugs.openvas.org -- Michael Wiegand | OpenPGP key: D7D049EC | http://www.intevation.de/ Intevation GmbH, Neuer Graben 17, 49074 Osnabrück | AG Osnabrück, HR B 18998 Geschäftsführer: Frank Koormann, Bernhard Reiter, Dr. Jan-Oliver Wagner _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

• This message: [ Message body ]
• Next message: Bernardo Damele A. G.: "[Full-disclosure] [Tool] sqlmap 0.6.3 released"

• Contemporary messages sorted: [ By Date ] [ By Thread ] [ By Subject ] [ By Author ]