Audit operational system libs
Master librarian to audit system libraries
Etymology
Hello ladies and gentlemen of my gitbook, so in this story told, we go to enter in familiar context when we audit a Unix-like system, something like Linux, macOS, FreeBSD or OpenBSD. For each operating system, it's common to see a lot of C language libraries, such as OpenSSL lib, lib ImageMagick, lib gzip and soon. So looking at this context, cybersecurity professionals always owe to audit operational systems library versions. With every new operating system in hand, an audit routine is necessary. Sometimes it's boring, but yes, necessary.
Yes, a lot of sysadmins automatize all tasks. It's intelligent. Still, sometimes resources like "apt, yum, Pacman, ports, brew" do not offer complete coverage for all library vulnerabilities. Yes, because every minute exists the possibility of releasing of new CVE. For this update exists a delay because the operating system developer needs to understand the context and create a proper patch for vulnerabilities and share in a global tree for another user update and fix vulnerabilities. Yes, just a hypothetical explanation, proper in many operational systems, delays in patches exist.
The motivation
The motivation for auditing Linux libraries using pkg-config to enumerate libraries and correlate them to CVEs in the NIST database is to improve the security of the libraries and the applications that use them. By using pkg-config to enumerate the libraries that are installed on a Linux system, we can identify which libraries are being used and which versions of those libraries are installed.
By comparing the libraries to the NIST database of Common Vulnerabilities and Exposures (CVEs), we can determine if any libraries have known vulnerabilities. We can take steps to update or remove vulnerable libraries to improve the security of our system.
Auditing Linux libraries using pkg-config and the NIST database can also help identify potential security issues with the libraries and the applications that use them. By examining the libraries and their dependencies, we can identify potential areas of weakness or potential vulnerabilities, and we can take steps to address those issues and improve the security of our system.
Overall, the motivation for auditing Linux libraries using pkg-config and the NIST database is to improve the security of the libraries and the applications that use them and to identify and address potential security issues. This can help we protect our Linux system and the data and applications that run on it.
Looking at These facts, finally, we can justify the creation of a proper tool to solve a part of that problem. So now we can meet the tool "master librarian", an exciting course to try to help audit operational system libraries in this context.
The master librarian
Well, the function of Master librarian is rhetoric; first, the tool uses pkg-config resources to list all libraries used by the operational system. In the second step, the tool uses the output buffer of the first step, and the tool sends each library with the correct version to the NIST vulnerability database in the second step. The last step is to check if a public vulnerability exists in the library context. All right here? Let's go to a practical example in the following:
To install requirements:
Overview:
Example:
output
Tested in Ubuntu Linux, Fedora Linux and FreeBSD.
The purpose of this tool is to use it in local pentest and pay attention if we have proper authorization before using that. I do not have responsibility for our actions. We can use a hammer to construct a house or destroy it, choose the law path, don't be a bad guy, remember.
Thank you for reading.
Cheers!
Another tip
Last updated