Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have some software that I want to upgrade to improve security. The current version I'm on is 2.6.2. Is it better to upgrade to the latest version of the entire product line which is 2.8 or should I upgrade to the latest version of my current product which is 2.6.7?

share|improve this question

2 Answers 2

up vote 7 down vote accepted

There is no absolute, consensual and systematic convention for versioning. Every vendor numbers his successive product versions as he sees fit. I mean, even Microsoft decided that the next version after "2000" was "XP", followed by "Vista", then "7", then "2008". I do not know what logic this follows, but I doubt it is from Earth.

Usually, vendors try to adhere to a scheme where products have releases (each new release possibly making some substantial changes with regards to the previous release) and releases have sub-versions which are limited to bugfixes, including (most importantly) security fixes. Hence, my wild guess is that upgrade to version "2.6.7" of your software should fix security issues which are known to impact version "2.6.2" (if there are any), but not bring any new feature, and should (hopefully) be easy to apply. On the other hand, upgrading to version "2.8" is switching to a new product line, with new features, and this may break compatibility with the rest of your system, which has been configured to talk with version 2.6.

Note that some vendors of widespread software do not follow such a scheme. In particular, Web browser vendors (in the case of, at least, Firefox and Chrome) tend to follow the simpler scheme known as "use the latest version or die". Version numbers are then meaningless integers whose only merit is to be bigger than the version number of the competitors (fortunately, there is no shortage of natural integers).

But you really should see what the vendor documents about his versioning system, since each vendor has his own conventions. As @RoryAlsop explains, this documentation can take several forms, including changelogs; and, of course, testing is paramount: don't upgrade any critical system until you have some good indications that the new version actually does the job...

share|improve this answer
1  
One thing to note that if the naming convention is really as you suggest, it might be important to check if the vendor is still supporting the 2.6 line with bug fixes and such. –  Terry Chia Sep 3 '12 at 1:22

This will entirely depend on what has been changed in those versions.

I would expect that you will have performance fixes, security fixes etc - which would make it a good idea to upgrade - but you may also have new functionality added in, which could add security vulnerabilities.

So, read the changelogs for the versions between where you are and the latest one (or talk to the vendor to see what changes have been made), check out cvsdetails for any known vulnerabilities, and then, if appropriate test the upgrade to make sure it doesn't break anything.

Then run a penetration test against it - and if that comes out okay, upgrade.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.