We’ve started to implement the Nessus scanner in our workplace. After the initial set of scans, we have started to work on addressing the found vulnerabilities. Thus lies a question or an issue.
We have a couple of machines that have a vulnerability that was patched in Nov 2020. However, these couple of machines didn’t get the patch, as it was superseded by Microsoft, which in turn, our patch management software marked it as superseded and didn’t deploy it.
Come Dec 2020, the patch that superseded Novembers patch was also superseded. Thus these machines didn’t get that patch either. Come Jan 2021, I am testing the current patch releases before releasing to production.
I was able to manually download the Nov patch from the Windows update catalog and apply it to these machines. I re-ran the Nessus remediation scan, and these machines are still listed as vulnerable. According to Nessus, a particular file in the System32 folder needed to change versions to mitigate this vulnerability. I then manually downloaded the superseded Dec patch and applied it to these machines. Again running the remediation scan, they show as vulnerable. And yet, the file in the system32 folder still remains on the old version number, but has a new modified date.
I jumped to manually downloading the Jan patch, though not tested (this would be my test), applied it and ran the scan again. The file still is on the older version number, but does have a new modified date. And the machines are still listed as vulnerable in Nessus due to this.
Since these machines were on Windows 10 ver 1809, I upgraded one to ver 1909 and the other to 20H2. After the upgrade, the file in the system32 folder only changed version number on the Windows 10 20H2 upgrade. It changed the modified date only on the 1909 upgrade but is still listed as vulnerable.
What’s the possibilities that just because the file doesn’t have the listed required file version in Nessus, that the vulnerability is actually a false positive? I’ve checked for prerequisites on the patches and everything else is installed.