CVE test with binaries?

[Hipska]

What about CVE's that need a binary (compiled c code) to test if the system is vulnerable? How should that be addressed?

See for example the test code for CVE-2015-0235 aka GHOST

[ghoneycutt]

Interesting. We could test if it exists and then run it. Perhaps, check for it in $PATH, then check for an environment variable, $CVE_FACTS_PATH, to see if it is in that path, then perhaps a standard directory, /opt/cve_facts. First time it finds $WHEREVER/ghost it uses that binary. What do you think?

[Hipska]

okay and where should source code be inlcuded in this repo or not at all? Another thought: puppet could be used to place the binary.

[ghoneycutt]

Puppet could place the source code, but it needs to be compiled on your local system. I'm ok with including it or not as you would like.

[Hipska]

Until I know where I could put the ghost.c file, I have a fact that checks only on RHEL systems. see #7