Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

I have a list of applied security patches and updates, exported from Windows server 2003.

The exported list is in CSV format, but converting it is not a problem for me.

Is there any tool/site/script that will check this list and will return me the list of missing updates?

share|improve this question
As an alternative, do you know where can I find current list of security patches available for Windows Servers? I can differentiate this list with the list I have and solve the problem like this... – Boaz Tirosh Oct 24 '12 at 11:05
Can't you just run Windows Update and see the list of hotfixes it says are applicable? – Polynomial Oct 24 '12 at 11:14
I don't have access to Windows Server 2K3, also I need a list in some kind of a text format, so I can differentiate the lists automatically... If you mean I should do so from the server, I don't have access to it anymore. – Boaz Tirosh Oct 24 '12 at 11:28
2  
I'm not sure why this is useful. If you're going to the effort of extracting a CSV of applied patches from the server, why not just run Windows Update on the server instead? Even if you don't have access to that box, someone must have in order to get the list in the first place. This all seems rather redundant... – Polynomial Oct 24 '12 at 11:42
@Polynomial To a certain degree, this might make sense if the target system is isolated from the main network. In those cases however, the best answer is to set up a portable updating solution like WSUS on a USB HDD or GFI LanGuard on a laptop. – Iszi Oct 24 '12 at 13:02
show 1 more comment

3 Answers

up vote 1 down vote accepted

I would recommend Iszi's answers above, but since you do not have access anymore these may not be feasible. I am not aware of any complete list out there listing all patches for a given platform, since the missing patches would also depend upon some other things installed that are not necessarily required (drivers, .NET, etc.). If you do not have access you are not the one who could implement the changes anyway. However, that said... you could install another fresh windows install, apply all patches, export the list, then diff them.

I just found this list of patches released for 2003: http://support.microsoft.com/kb/914962 . It might be a good start for you.

share|improve this answer
up vote 0 down vote

It seems like you're really trying to go the long way around, here. What you need is an offline updating solution, and there are some options available.

WSUS Offline Update allows you to download Windows Update patches to a USB drive, and install them on another computer that doesn't have an Internet connection. You can download all available updates, and let the remote computer then figure out the ones it doesn't need.

Vulnerability scanners like Nexpose, Nessus, McAfee Vulnerability Manager and GFI LanGuard can be installed on portable platforms (e.g.: laptops). These will evaluate the installed software and configuration of your system over a network connection (you will, of course, have to plug the laptop into the same network as the target system or connect directly via crossover cable) and provide a comprehensive list of missing patches and configuration flaws. This will include not only necessary Windows updates, but also updates for many other programs. Some scanners even include a patch management system, which can be used to automatically push needed updates to the system after a scan - even without actually installing client software on the target.

share|improve this answer
I did this test as part of a more general audit, I am not the server administrator and not allowed to make changes to the server. Also I don't have access to the server anymore. – Boaz Tirosh Oct 24 '12 at 14:08
up vote 0 down vote

You may be able to reverse engineer a list of patches by looking at Microsoft's archive of security bulletins. Be a hell of a job though.

Better would be if you can get the server admins to re-run the analysis for you, but this time use the proper tool for the job, Microsoft Baseline Security Analyser, since that will tell you what's missing, rather than what's installed.

Failing both of those, you can try building a 2003 server and running MBSA on it without applying any patches, to see what it thinks you should install. That might not be 100% exact, but might be enough to tell you if their patching process is working.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.