Linux Vulnerability Scanner: Vuls

---

Vulnerability scanner for Linux, agentless, written in golang

---

    For a system administrator, having to perform security vulnerability analysis and software update on a daily basis can be a burden. To avoid downtime in production environment, it is common for system administrator to choose not to use the automatic update option provided by package manager and to perform update manually. This leads to the following problems.

• System administrator will have to constantly watch out for any new vulnerabilities in NVD(National Vulnerability Database) and etc.
• It might be impossible for the system administrator to monitor all the software if there are a large number of software installed in server.
• It is expensive to perform analysis to determine the servers affected by new vulnerabilities. The possibility of overlooking a server or two during analysis is there.

Vuls is a tool created to solve the problems listed above. It has the following characteristics.

• Informs users of the vulnerabilities that are related to the system.
• Informs users of the servers that are affected.
• Vulnerability detection is done automatically to prevent any oversight.
• Report is generated on regular basis using CRON etc. to manage vulnerability.

Main Features

• Scan for any vulnerabilities in Linux Server
  • Supports Ubuntu, Debian, CentOS, Amazon Linux, RHEL
  • Cloud, on-premise, Docker
• Scan middleware that are not included in OS package management
  • Scan middleware, programming language libraries and framework for vulnerability
  • Support software registered in CPE
• Agentless architecture
  • User is required to only setup one machine that is connected to other target servers via SSH
• Auto generation of configuration file template
  • Auto detection of servers set using CIDR, generate configuration file template
• Email and Slack notification is possible (supports Japanese language)
• Scan result is viewable on accessory software, TUI Viewer terminal.

Linux Vulnerability Scanner Architecture

---

go-cve-dictinary

• Fetch vulnerability information from NVD, JVN(Japanese), then insert into SQLite.

Vuls

• Scan vulnerabilities on the servers and create a list of the CVE ID
• For more detailed information of the detected CVE, send HTTP request to go-cve-dictinary
• Send a report by Slack, Email
• System operator can view the latest report by terminal

---

Supported OS

Distribution	Release
Ubuntu	12, 14, 16
Debian	7, 8
RHEL	4, 5, 6, 7
CentOS	5, 6, 7
Amazon Linux	All