Method of identifying software vulnerabilities on a computer system

• US 8,230,497 B2
• Filed: 11/04/2002
• Issued: 07/24/2012
• Est. Priority Date: 11/04/2002
• Status: Active Grant

• Current Assignee: Flash Uplink LLC (Quest Patent Research Corporation)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Norman, Andrew Patrick, Brawn, John Melvin, Griffin, Jonathan, Scrimsher, John P
• Primary Examiner(s): Flynn, Nathan
• Assistant Examiner(s): AVERY, JEREMIAH L
• Application Number:
  US10/287,125
• Publication Number:
  US 20040088565A1
• Time in Patent Office: 3,550 Days
• Field of Search: 726/22
• US Class Current: 726/22
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A method of identifying a software vulnerability on a computer system is disclosed in which the computer system has software stored thereon and is connected to a management system over a computer network. The method comprises the steps of: applying an interrogation program to the software, the interrogation program being capable of exploiting a known software vulnerability if it is present in the software to which the interrogation program is applied; in the event that the software vulnerability is exploited by the interrogation program, operating the interrogation program to generate a set of management information from which can be derived the identification of the computer system; and sending the management information to the management system.

Claims

1. A computer program stored on a non-transitory computer usable medium, the computer program comprising computer-readable instructions arranged to operate under the control of a processing means so as to identify a software vulnerability on a computer system, the computer program performing the steps of:

selecting one or more computer systems to be scanned for a software vulnerability;

applying an interrogation program to software stored on the computer system, the interrogation program being capable of exploiting a known software vulnerability if it is present in the software to which the interrogation program is applied; and

in the event that the software vulnerability is exploited by the interrogation program, operating the interrogation program to generate a set of management information from which can be derived at least an identification of the computer system on which the software vulnerability was exploited, the computer program being capable of sending the generated set of management information over a computer network,

wherein the interrogation program is further arranged to remediate the known software vulnerability in response to it being identified.

2. A computer program stored on a non-transitory computer usable medium, the computer program comprising computer-readable instructions arranged to operate under the control of a processing means so as to identify software vulnerabilities in a computer network to which the processing means is connected, the computer network comprising a plurality of computer systems having software stored thereon, the computer program performing the steps of:

(a) sending at least one interrogation program to each computer system selected by a user to be scanned for a software vulnerability, the at least one interrogation program being arranged to exploit a known software vulnerability if it is present in the software of the computer system to which the interrogation program is applied, and operating the at least one interrogation program to generate management information at the computer system on which a known software vulnerability is exploited, the management information identifying the computer system and the particular software vulnerability present on that computer system; and

(b) receiving management information generated by each interrogation program, wherein the at least one interrogation program sent by the computer program is further capable of remediating the software vulnerability it is capable of identifying, and wherein in the event that the interrogation program identifies a software vulnerability, the interrogation program operates to remediate said software vulnerability.

3. A computer program according to claim 2, wherein the computer program is arranged to generate, in accordance with the received management information, a database of computer systems on the computer network which have particular software vulnerabilities.

4. A computer program according to claim 2, wherein the management information includes a respective network address associated with each computer system on which the software vulnerability was identified.

5. A computer program according to claim 4, wherein the network address is an IP address of the respective computer system.

6. A computer program according to claim 2, wherein, in response to receiving management information from an interrogation program indicating the presence of a particular software vulnerability, the computer program receives a remediation program appropriate to the particular software vulnerability and sends said retrieved remediation program to the interrogation program.

7. A computer program stored on a non-transitory computer usable medium, the computer program comprising computer-readable instructions arranged to operate under the control of a processing mean so as to identify a software vulnerability on a computer system having software stored thereon, the computer program being arranged:

to interrogate the software of the computer system to detect the presence of a known software vulnerability if it is present in the software, wherein the computer system is designated by a user to be scanned for a software vulnerability;

in the event that a vulnerability is detected, to generate a set of management information from which can be derived an identification of the computer system;

to send the set of management information to a computer network; and

to remediate the known software vulnerability in response to it being identified.

8. A computer network comprising:

a scanning system;

a management system; and

a plurality of computer systems, the scanning system being arranged to send at least one interrogation program to each of the computer systems selected by a user to be scanned for a software vulnerability, the at least one interrogation program being arranged to exploit a known software vulnerability if it is present in software of a computer system to which the interrogation program is applied, to generate management information in the event that a known software vulnerability is exploited, and to send the generated management information to the management system, the management information identifying the computer system on which the known vulnerability was exploited and the particular software vulnerability present on that computer system, wherein the at least one interrogation program is further arranged to remediate the known software vulnerability in response to it being identified.

9. A method of identifying a software vulnerability on a computer system having software stored thereon, the computer system being connected to a management system over a computer network, the method comprising:

selecting one or more computer systems to be scanned for a software vulnerability;

applying an interrogation program to the software, the interrogation program being capable of exploiting a known software vulnerability if it is present in the software to which the interrogation program is applied;

in the event that a software vulnerability is exploited by the interrogation program, operating the interrogation program to generate a set of management information from which can be derived the identification of the computer system having the software vulnerability; and

sending the set of management information to the management system via the computer network, wherein the interrogation program is further arranged to remediate the known software vulnerability in response to it being identified, and, wherein the management system selects the interrogation program that is applied to the software.

10. A method of identifying a software vulnerability on a computer system having software stored thereon, the computer system being connected to a management system over a computer network, the method comprising:

selecting one or more computer systems to be scanned for a software vulnerability;

applying an interrogation program to the software, the interrogation program being capable of (i) exploiting a known software vulnerability if it is present in the software to which the interrogation program is applied and (ii) remediating the known software vulnerability it is arranged to exploit;

in the event that a software vulnerability is exploited by the interrogation program, operating the interrogation program to remediate the software vulnerability so exploited and generate a set of management information from which can be derived an identification of the computer system having the software vulnerability; and

sending the set of management information to the management

system via the computer network, wherein the management system selects the interrogation program that is applied to the software.