A patch is small program that updates another program, usually to fix a specific issue. Patches are also often called fixes.

learn more… | top users | synonyms

1
vote
0answers
30 views

Does the Java version matter when compiling an Android, Amazon, or Blackberry app? (for security reasons)

I need to compile an app that will run on an Android, or Android compatible system (Android, Amazon Fire, or Blackberry). The developer documentation says that JDK 7 is needed, however there are ...
1
vote
1answer
507 views

Is the 'SUIDGuard' patch safe to implement?

Can someone who really knows what they're looking at advise whether the patch published here by Stefan Esser is in fact safe to install? While I'm very concerned that Apple haven't published an ...
1
vote
2answers
55 views

Where to check if a specific OS / service is vulnerable despite being patched, because of a vendor's decision?

I need to discuss how to mitigate the risk of services which are vulnerable despite being patched (typically because they are not maintained by the vendor anymore, or because the vendor does not want ...
3
votes
1answer
101 views

Is a newly installed server with no services running (but connected to the web) at risk?

A new server has just been installed but literally has nothing else running on it, no services setup to SSH in or anything yet (it's a Linux server). However, it is hooked up to the web so I can ...
3
votes
1answer
210 views

At what criteria should an unpatched machine be considered hacked? [closed]

Since every machine connected to the Internet requires security patches, there is a window of time in which those updates have been released and those machines haven't yet been patched. It is ...
2
votes
2answers
149 views

Should I update my openSSL package? [closed]

This link talks about the new patches to be released by OpenSSL Foundation very soon. It says: In a mailing list note published last night, Matt Caswell of the OpenSSL Project Team announced ...
0
votes
2answers
110 views

How frequently install patches in an enterprise environment?

We're trying to implement a patch schedule in our environment for both linux and windows systems. I'm curious to hear how often other enterprise companies are patching their servers so we can get an ...
3
votes
2answers
93 views

Is it possible to “fingerprint” the “patches” applied to a Windows system?

Two situations with a similar goal: 1) You have access to a target network, and you a Windows host. Is it possible to remotely finger print which (operating system security) patches are applied to ...
-5
votes
1answer
141 views

RC4 and Crypto Ransomware [closed]

If we allow no RC4 support on any devices, will Crypto Ransomware be slowed down or eliminated? Is this a patching and not a malware problem? Can we block this threat at the packet level?
3
votes
2answers
210 views

Microsoft recommended patching period - Security Patch release and updates

Ideally a security patch released by a vendor such as Microsoft for the Windows OS is required to be patched immediately. What would be the recommended patching period that Microsoft or best practices ...
1
vote
1answer
32 views

What account should be used to install SQL Server 2008 patches?

The company I work for is currently going undertaking a project to remediate (among other things) a pen-test finding that a privileged domain-level account (which was compromised by the pen-testers ...
1
vote
5answers
105 views

Beyond patching, how can I reduce the risk of browser exploits?

Keeping web browsers on the most up to date version and also the plugins that are used is pretty much all we do. Is there anything I else I can do to reduce the risk of browser exploits? The only ...
1
vote
1answer
705 views

How do I view a list of known unpatched windows xp arbitrary code execution vulnerabilities? [duplicate]

I know there is secunia and cve.mitre and ms kb database but I could not find a way to filter results only for operating system "windows xp" (or 2003 server, they share about the same code) with ...
0
votes
2answers
177 views

Is openVZ patched against all exploits for its current kernel version?

I am looking for a container vitalization software that will allow me to create containers that will house specific software/jobs/tasks which I can start stop at will (and bind to interface aliases). ...
27
votes
1answer
3k views

What questions should be asked when joining a new security team? [closed]

I've accepted a position at a different company working on their security team and have been mentally putting together a list of questions to ask so I can rapidly get up to speed in the environment ...
1
vote
3answers
59 views

How do to keep programs updated

We all know we should keep our programs up to date, after all each of them could have an unlatched security hole that was fixed in the latest update. However the average computer easily contains 200+ ...
-2
votes
1answer
66 views

Does using a non Nexus/Google Play Editon Android device have a higher security risk? [closed]

The fact that carriers deploy the latest security updates to Android devices much later than Google does to Google Play Edition and Nexus devices, should we avoid using those devices altogether?
4
votes
3answers
404 views

Security of a Windows XP system after April 8th when running the latest Firefox or Chrome

As we all know, Microsoft stops developing security patches for Windows XP very soon. If a bug in the kernel was to be found that would allow an attacker to take control by, say, sending a specially ...
20
votes
8answers
4k views

How could someone exploit the OS an ATM is running?

As I'm sure many of you have heard, the end of support for Windows XP is the supposed apocalypse for ATM's worldwide. I am cognizant of the fact that this ensures that no more patches are issued, and ...
1
vote
1answer
37 views

Is there a place where we can see which Microsoft's KB replaces which Microsoft's KB?

Do you If there is a simple listing of which KB replaces which KB in Microsoft development because every report from Microsoft explain one by one which KB replaces which KB, but I can't find a place ...
1
vote
1answer
221 views

Security risks if a server in not supported anymore

I have an SQL 2000 database server which is not supported by Microsoft anymore. We have our information security policy applied and even PCI requirements. What are the security risks that we might ...
0
votes
4answers
283 views

What is a good way to be alerted of major security patches for software I use? [duplicate]

I maintain a few webservers running ubuntu, apache, mysql, and python/django. I update all the libraries quarterly, but I'd like to update more often when a patch for a major vulnerability is ...
0
votes
4answers
103 views

Securing an automatic updater

Scenario You have a launcher for some software, it allows you to execute the software but it will also allow you to switch versions and upgrade to newer versions. When the launcher is executed, it ...
0
votes
1answer
139 views

Is it ever safe to install patches in parallel on a Windows OS? When must I reboot after each patch?

It comes to my attention that not all installers are aware of each other (Windows Update, vs some hotfix and service pack installers) and block concurrent execution. For example, I'm able to run ...
1
vote
1answer
133 views

Notification or report for security problem of unix systems? [duplicate]

I have unix systems(Solaris,Oracle,Redhat vs).I have to control all system for security problem,bugs,patch,vulnerabilities I'm looking for securty information for all security issue After that I'll ...
2
votes
3answers
882 views

How important is patch management?

Problem I'm trying to sell the idea of organizational patch/update management and antivirus management to my superiors. Thus far, my proposition has been met with two responses: We haven't had any ...
2
votes
1answer
168 views

What is the difference between APSA and APSB?

What would be the difference between Adobe APSA and APSB security bulletins / advisories?
0
votes
1answer
290 views

Windows 7 File Patching, Custom Visual Styles

In order to apply custom "visual styles" or themes in Windows 7, you must patch a few system files including Explorer. I can see from the start how this could be a potential security problem, but how ...
1
vote
1answer
320 views

Padding oracle - Vulnerable Version of ASP.NET

I would like to install the vulnerable version of ASP.NET for testing purposes. I've thought about it and I guess the best way would be to delete/disable some security updates to make that possible. ...
0
votes
1answer
271 views

How to analyze server crash dump after recent patch update? [closed]

I want to know, if there a way I can identify on windows systems an event / log generated due to patches incorrectly installed / or corrupted in the process. Is there a way I can process or look ...
6
votes
1answer
470 views

Security announcement mailing list for Java

I didn't find a security announcement mailing list for Java (from Oracle). How to get notified about new Java patches? I am not interested in other Oracle products. For example Apple provides such a ...
3
votes
4answers
3k views

What reputable site should I download Putty from?

I recently did a Bing search for Putty and can only guess at which distribution is "trusted", contains no malware, or sleuthing code. If you needed to download Putty for a high security Windows ...
1
vote
1answer
100 views

Zero day vulnerability appropriate corrective action

Is it appropriate for a software developer to provide zero day vulnerability corrections as at-user-discretion installers to apply patches or is it preferred to force it in cyclic updates? The reason ...
5
votes
1answer
160 views

Does every security patch get back ported to every .NET framework? Are there exceptions to the rule?

I can imagine a scenario where Microsoft will create a security patch for some versions of .NET and not others. This might occur in occasions it's too expensive to regression test and back port all ...
0
votes
2answers
2k views

List of unpatchable exploits in MS Exchange 2003 [duplicate]

Possible Duplicate: Where can I find a list of un-patched CVEs for a specific piece of software? MS Exchange 2003 is no longer supported by Microsoft since April 2009. However the ...
14
votes
3answers
494 views

Android security without updates

I have an android phone which, like many others, has quickly become unsupported and is not receiving any updates. At the same time there are publicly available exploits for privilege-escalation ...
4
votes
2answers
775 views

Is there any way to use Nuget securely?

Visual Studio now includes a Package Manager that downloads and updates software packages from the internet. The common name for this is "Nuget" The problem I have is that anyone can pretend to be ...
67
votes
15answers
6k views

How to write an email regarding IT Security that will be read, and not ignored by the end user?

I've observed that several of our users are ignoring messages sent from IT Security managers, and also the system generated "You just sent a virus" notifications. The problem seems to be among people ...
4
votes
3answers
426 views

How can IT audit for installation of IIS Express?

IIS Express is a developer tool for Windows XP and higher which provides the full feature set of IIS, but without needing administrator rights. I've seen discussion by some developers who are ...
5
votes
2answers
378 views

Patching Mechanism and security holes

Let me clarify two methods of patching softwares and then I will go straight to the question: I am using both MAC OS X and Windows and different mechanisms of these two famous operating systems in ...
6
votes
1answer
7k views

Download Windows 7 security updates and patch offline

I am planning to do a clean Windows 7 OS installation. Is it possible (and/or recommendable) to download all the Windows 7 Security Updates from Microsoft in advance and patch my fresh Windows 7 ...
5
votes
3answers
470 views

Are Windows security updates audited?

An IT guy said that in his company, the Windows updates (small security updates that are downloaded automatically by the Windows autoupdate) are checked by the auditor. ie: the auditor checks if every ...