This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Firmware Vulnerability data files URLs don't function, new ones I think require product update

cnorborg over 8 years ago

Was noticing that no new recent vulnerabilities are showing up in NCM, so I went to check things out.

In my Firmware Vulnerability Settings page, I'm getting the following errors -

URL "http://static.nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-recent.xml" is currently inaccessible.

URL "http://static.nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-modified.xml" is currently inaccessible.

If you go to those URL's it says that "Effective October 16, 2015 the XML data feeds will no longer be available for download in an uncompressed format.

You have reached this page because you have a process that links directly to a file that no longer exists. Please modify your process to use the compressed format as described on the main NVD Datafeeds landing page."

If you go to the NVD Datafeeds landing page (NVD - Data Feeds), there are links to the compressed version of the two files above in either GZIP or ZIP format

http://static.nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-Modified.xml.gz

http://static.nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-Modified.xml.zip

http://static.nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-Recent.xml.gz‌

http://static.nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-Recent.xml.zip‌

Its fairly easy to unzip them and drop them in to the correct directory, which is shown in the Settings page, but I thought maybe a product update to fix this is in order?

Top Replies

0 cvachovecj over 8 years ago

Yep, we know. Fix is on the way.
In the meantime, you have the workaround you described. We even have an official document for this.
Jiri
Cancel
Vote Up +3 Vote Down

Cancel
0 squinsey over 8 years ago in reply to cvachovecj

Excellent thanks Jiri.
We too have extracted manually and I was pushing my IT Governance team to advise their prefered source.
Funny enough their ignorance shined even though I'd shown them NCM.
Think they have been far too worried about application vulnerabilities of late and forgotten about hardware
Cancel
Vote Up 0 Vote Down

Cancel
0 piharrison over 8 years ago in reply to cvachovecj

Any update Jiri?
Cancel
Vote Up 0 Vote Down

Cancel
0 cvachovecj over 8 years ago in reply to piharrison

Yes. This issue is fixed in NCM 7.4.1. Please see the release notes: SolarWinds Network Configuration Manager v7.4.1 Release Notes.
Jiri
Cancel
Vote Up +2 Vote Down

Cancel
0 fnguyen over 8 years ago in reply to cvachovecj

I have upgraded my NCM to 7.4.1 and still encounter the same issue. My temp. work around is to run a Powershell script to download the zip files and unzip them into this folder \ProgramData\Solarwinds\NCM\Vuln\Xml. However, I still see ton of alerts like such:
Download of vulnerability datafile failed
In NCM settings, I unchecked the box "Direct urls to xml vulneratbility announcements...." and keep only "Enable daily auto run of vulnerability matching logic" checked. The location of folder for data import is still pointing to where the xml files were extracted to. Any idea?
Cancel
Vote Up 0 Vote Down

Cancel
0 cvachovecj over 8 years ago in reply to fnguyen

Try to use the default settings (see below). That works for me.
You might also test the URLs to make sure they are not blocked in your network -- just paste them into a browser.
Jiri
Cancel
Vote Up 0 Vote Down

Cancel
0 fnguyen over 8 years ago in reply to cvachovecj

Well, I have no problem accessing the links mentioned above and that was exactly what I put in my setting before but it still didn't work. NCM downloaded the zip files, but there was no way for it to unzip them. That's when I use a script to schedule a download and then automatically unzip them to \ProgramData\Solarwinds\NCM\Vuln\Xml. I can see that NCM picks up the new xml files during scanning, but still see this alert:
That's when I decided to disable the URL part: to see if I can get rid of the alert, still no go:
Cancel
Vote Up 0 Vote Down

Cancel
0 fnguyen over 8 years ago in reply to fnguyen

does anybody have a work around or fix?
Cancel
Vote Up 0 Vote Down

Cancel
0 cvachovecj over 8 years ago in reply to fnguyen

Then disable the alert.
Jiri
Cancel
Vote Up 0 Vote Down

Cancel
0 jeff.stewart over 8 years ago in reply to cvachovecj

The other option is to try updating the alert date set in the trigger condition. I would set the date to something in the future (a day out) and then see if things clear up after that. I believe we are looking from the date set until today (or the current date) for any failures within the audit log.
Cancel
Vote Up 0 Vote Down

Cancel