Penetration Testing mailing list archives
Re: MBSA scanner
From: Javier Fernandez-Sanguino <jfernandez () germinus com>
Date: Thu, 06 May 2004 10:31:33 +0200
Rob Shein wrote:
I think you're confusing code with output. The licenses you cite with regard to both SARA and MBSA have restrictions upon redistribution of theproduct, not the output of the product.
I'm confusing them because output might _include_ significant information that is in the code. The license covers both the software and the reports they generate, it does not explicitly exclude the later (so under copyright laws it _is_ included).
Again, notice that the output of the product is based on (sometimes lengthy) information that is included in the code of the product. So, all the suggestions on how to fix a vulnerability that a report might include are like a "knowledge base" of sorts, which is copyrighted. This includes also detailed information on a vulnerabilities (what does it do, how does it affect a system). Without the original author's permission you can't translate that at will, you cannot provide that report as a commercial offering (inside a report or standalone) and you cannot (taking it to the extreme) include the information from that report into your new brand vulnerability assesment tool with different code to assess the vulnerabilities but similar output.
Notice that, if that was permitted under copyright law, there would be nothing preventing Nessus, Internet Scanner, Cybercop, Retina, you_name_it from using the same vulnerability database. If you consider the output in the public domain you could run a test against a host that turns out vulnerable to everything that is in the database (maybe faking the answers) and then copy the information from the report to your propietary or free vulnerability assesment system. That's obviously illegal.
With regard to SAINT, however, you may have a point. Nessus is another example; the GPL has the same restrictions on distribution in either binary or source code format for money, but it's very clear that using Nessus in the course of one's work and including its output in the deliverable is entirely acceptable within the license terms.
That's because Reanud, as well as other Nessus developers (me included) wanted to make a distinction in that side. Notice that the output of Nessus is still copyrighted (it's part of the NASL script) and you cannot do whatever you like (such as including it in a closed source scanner)
Please read the thread in the Nessus plugins writers that started at http://list.nessus.org/plugins-writers/0312/1001.html And also read the GPL FAQ: "In what cases is the output of a GPL program covered by the GPL too?" (http://www.gnu.org/licenses/gpl-faq.html#TOCWhatCaseIsOutputGPL) and"Is there some way that I can GPL the output people get from use of my program? For example, if my program is used to develop hardware designs, can I require that these designs must be free?"
(http://www.gnu.org/licenses/gpl-faq.html#TOCGPLOutput) Regards Javier ------------------------------------------------------------------------------ Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off any course! All of our class sizes are guaranteed to be 10 students or less to facilitate one-on-one interaction with one of our expert instructors. Attend a course taught by an expert instructor with years of in-the-field pen testing experience in our state of the art hacking lab. Master the skills of an Ethical Hacker to better assess the security of your organization. Visit us at: http://www.infosecinstitute.com/courses/ethical_hacking_training.html -------------------------------------------------------------------------------
Current thread:
- Re: MBSA scanner Javier Fernandez-Sanguino (May 04)
- RE: MBSA scanner Rob Shein (May 04)
- Re: MBSA scanner Javier Fernandez-Sanguino (May 06)
- RE: MBSA scanner Rob Shein (May 06)
- RE: MBSA scanner JTH (May 06)
- Re: MBSA scanner Javier Fernandez-Sanguino (May 06)
- Re: MBSA scanner Igor Filippov (May 04)
- <Possible follow-ups>
- RE: MBSA scanner Steven Trewick (May 06)
- Re: MBSA scanner Javier Fernandez-Sanguino (May 10)
- RE: MBSA scanner Steven Trewick (May 10)
- Re: MBSA scanner Javier Fernandez-Sanguino (May 11)
- RE: MBSA scanner Rob Shein (May 04)