Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have several systems that require PCI compliance, all of them are running CentOS 6.4 with all security updates applied daily. However, PCI compliance scanning will often reject detected versions of external services (Apache, PHP, MySQL) that it deems to be insecure. The measurement of security is simply the version number of the software package--if that information is reported to the scanner vs. having all version information turned off to the outside world by defining a less verbose configuration.

I have a brand new CentOS 6.4 box that I am securing and it has failed it's initial PCI scan (no surprise there). But the first issue reported says: "PHP 5.3 < 5.3.7 Multiple Vulnerabilities." The server currently has PHP 5.3.3, as supplied by CentOS. There are other failing packages as well, but I'll focus on PHP for this question.

Some points to consider

  • It's generally understood (I think) that Linux vendors claiming stability as a feature do not rush out every new version of a package released upstream, with an exception sometimes for web browsers/plugins.
  • Vendors do release security updates, but not for every source release. (Example: PHP 5.3.26 is the newest in the 5.3 releases, and it claims to fix CVE-2013-2110.)
  • Vendor packages sometimes leave the major.minor version number the same, but bump the release number with a security patch backported into their package for compatibility reasons. Therefore, it's possible a security issue has been fixed even if the version number doesn't suggest that. (PCI: This requires time consuming manual documentation to get a compliance override.)
  • I have seen arguments in the past that vendor packages can be more secure, on the basis that they can include non-standard patches to the source. That is rarely documented in a way that can be easily reviewed, though.
  • We roll our own packages to get newer releases of external services, such as PHP, updated quickly. It provides obscure bug fixes, too, which vendors are probably less concerned about.

To achieve PCI compliance, my experience shows that rolling custom packages is the only way to pass. We have used Security Metrics, Trust Wave, and Control Scan with various results. Does that mean vendor-supplied packages, including their security updates, are not enough because they lag too far behind the upstream releases?

Note: I am asking this question because I have seen plenty of "security advice" over time that recommends "Run yum upgrade daily to get your security updates," but a PCI scanner generally disagrees that enough effort has been made regarding the security of the installed versions.

share|improve this question
3  
A PCI scanner is dumb (or your QSA is lazy). See this Q/A at Server Fault: serverfault.com/questions/489008/… –  Deer Hunter Jun 22 '13 at 19:16
7  
Don't confuse "PCI DSS compliance" with "security". –  Bruce Ediger Jun 22 '13 at 21:13
2  
Did you try and remove/hide your version numbers from any online scanner. "ServerTokens Prod" ? Remember you are looking for the all clear from the scanning vendor to obtain compliance, information they don't have and can not obtain can't be used to hit you with. See above comment re "security", this tip is not security. –  Darryl Miles Sep 5 '13 at 22:48

1 Answer 1

PCI DSS requires that "the latest vendor-supplied security patches installed". (PCI 6.1 pg. 38). This means that if PHP releases a security patch, then you need to apply it, even if your distro doesn't have it in their repo yet.

Your rule-of-thumb is to look to the product version number and what the vendor (PHP, Apache, etc) has released, security-wise. Scanners and distro repos can help, but are not what needs to be checked or audited. Know what you have installed, and check for security updates regularly. Double-check your scanner results on a regular basis to account for false negatives, and confirm the findings to account for false positives.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.