Cve 2020-17008

#1

Hi guys,

I was wandering is CVE 2020-17008 false positive? I’m using Greenbone Security Manager, Greenbone OS 6.0.10, and keep getting this vulnerability in current month (February 2021), and not getting CVE-2021-1648 vulnerability.

Microsoft initially planned to patch this vulnerability as part of its November and December 2020 Patch Tuesday releases under a CVE identifier of CVE-2020-17008. However, due to testing issues, it was pushed back to January 2021. Because it slipped into 2021, Microsoft scrapped CVE-2020-17008 and now identifies it as CVE-2021-1648.

Regards,

#2

Hi Aleksandar,

What feed and platform do you use ?

If you are on a Microsoft Server, this vulnerabilities are no longer part of the Greenbone community feed. If you have purchased a Greenbone appliance including the Greenbone Security Feed, please open a support ticket to upgrade to GVM 20.08. Your installation is end of support by 01.01.2021 and the support helps you to upgrade.

I suggest you read our FAQ fist here:

#3

Hi Lukas,

Thanks for your answer.
We have used Greenbone gsm-ce-6.0.10.iso file to deploy VM.
Feed is updated every two/three days. Latest update obtained 20210222
NVT - Greenbone Community Feed
SCAP - Greenbone Community SCAP Feed
CERT - Greenbone Community CERT Feed

#4

Please upgrade to a supported OS first.

#5

Thank you! Can you provide me with purchase dept email address, so I can get in touch with and help us purchase adequate license for our needs? We need vulnerability scanner only, not vulnerability management. Is there such license?

What are GSM 20.80.4 (current version) limitations? Number of host scanned? Time limit? …

Thanks for all you help and patience!

#6

Hello all,

I am currently on the latest version of GVM (20.08) and I am also getting this. Community feeds are current as of today. This vulnerability test still appears to be in the feeds; the .nasl is:

“gb_ms_windows_kernel_elevation_of_privilege_vuln_dec20.nasl”

Thank you.