1

Does anyone know of a .dll scanner that searches for known vulnerabilities?

At work, we have a project which uses Nuget packages, and other .dll dependencies. I know there are databases of known vulnerabilities 12, but does anyone know of a tool that will scan a build output folder for .dll names/versions/etc. to spot .dlls with known vulnerabilities?

The goal will be to have this tool run periodically, and alert me if a vulnerability is found in our of our dependencies so that we can update it. Always staying up to date is a testing burden (still working on comprehensive automated testing!) so not updating our dependencies more than we have to is very necessary still for us.

Other information about the environment:

  • C# project/solution with VS 2015 Update 1
  • Does not have to be open source, and if it's pricey the business can probably afford it.

EDIT: I did not know that software recommendations were not appropriate for this site. I'm leaving it open on here (even though it will probably be closed) so that those who upvoted the post can find it again.

I re-posted the question on the appropriate stackexchange [here]

  • If this is a bad question for this site, is there a better stackexchange site for it? – Frank Bryce Jan 4 '16 at 19:24
  • OWASP Dependency Check is free and open source, and works for .Net projects. – Xander Jan 4 '16 at 19:27
  • Thanks for the response! I looked at that one, but the results are just a search query of the OWASP vulnerability database based on the name of the .dll. For instance, if the dll is named EntitySqlServerTools.dll (I made that up) then all the sql vulnerabilities show up in that result list, and make the EntitySqlServerTools.dll a "high" risk of vulnerability. With a lot of .dlls, this list takes hardly less time to sift through than doing the query and searching manually. – Frank Bryce Jan 4 '16 at 19:29
  • To be honest I have seen similar dependency tools for what you are looking for. But they end up just being a interface for DBs like OSWASP Depedency Check. And do no more than comparing the extension and version. This DB has such an interface. You can integrate it as CLI, CI, or other build tools to search your dependency folder and do the queries for you. jeremylong.github.io/DependencyCheck – Brad Metcalf Jan 4 '16 at 19:42
  • @BradMetcalf thanks for that link, it looks very useful and I'll give it a shot – Frank Bryce Jan 4 '16 at 19:45

Browse other questions tagged or ask your own question.