Vulnerability Information Sources

[gek-konijn]

hello guys,

I works as an IT-administrator and we spend allot of time and money going over all sources like secunia and vendor information to see what we should patch, update or look for on the network. What I would like to know what sources you use to keep up to date and why?

Hope to get some good tips.

[Sitwon]

http://cve.mitre.org/ because it's the most comprehensive list I'm aware of

[digininja]

There are a few companies who you can register with and give them details of all your software and versions and they will monitor things for you, can't remember any names off hand but you should be able to google them.

The free approach is probably twitter and the security focus mailing lists, especially full disclosure but that takes a lot of effort to sift out all the rubbish to get the few gems.

CVEs are good to watch but they can be a little behind the real world, I know one I submitted took quite a few weeks to get assigned a number.