Software vulnerability assessment: Version extraction and verification

Abstract

Software vendors do not on a regular basis label their products with the exact software version. This is contrary to branded household products where model numbers and serial numbers allows the consumer to identify the product and get assistance if something goes wrong. We investigated version and product information within 8468 different software programs, where freeware and shareware showed a considerable lack of relevant information. A tool is proposed for identifying relevant version information and for verifying potential threats matched against a software vulnerability database. We suggest that software vendors in the future conform to general conventions of storing version information in a standardized way. © 2007 IEEE.