The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
0answers
23 views

Best secure way to update back-end servers? [migrated]

Our back-end servers (Redhat 5,6 mostly) are very outdated, and are not connected to the Internet for security reasons. I'm looking for the best strategy to update them, without connecting them to ...
-4
votes
2answers
49 views

Is it possible to create your own security updates on Ubuntu 12.04? [closed]

My main Question is: Is it possible to create your own security packages? [ NOTE: I enjoy teaching myself new skills for many different things. So please give me an answer in a 4th grade reading ...
2
votes
0answers
209 views

What is going on with my download of the recent Apple security update?

The update in question is the Mavericks combined update which, among other things, claims to fix the recent SSL vulnerability/gaping hole. This issue really annoyed me, so I decided to procure ...
0
votes
1answer
32 views

programs or methods to review Internet browser applications for security [closed]

I've been tasked with doing a security review on a Firefox update, but we don't have any utilities that we can find. How would we go about running a security review on Firefox before pushing it to ...
0
votes
4answers
88 views

Securing an automatic updater

Scenario You have a launcher for some software, it allows you to execute the software but it will also allow you to switch versions and upgrade to newer versions. When the launcher is executed, it ...
1
vote
3answers
112 views

USGCB on a non-networked computer

We will be getting some data that needs to be kept in accordance with USGCB regulations. Our intent was to keep it secure by storing and using it on a non-networked computer, but the regulations seem ...
3
votes
1answer
136 views

Does Apple maintain the security of the built-in Ruby?

Does Apple maintain the security of the Ruby implementation that comes by default in OS X? I recently heard about CVE-2013-4073, but when I ran "Software Update..." on my OS X Lion box, it didn't ...
2
votes
3answers
302 views

How important is patch management?

Problem I'm trying to sell the idea of organizational patch/update management and antivirus management to my superiors. Thus far, my proposition has been met with two responses: We haven't had any ...
4
votes
6answers
379 views

Best source(s) for security related news? [closed]

What is the best place to go for security news? I am looking for everything from news updates to editorials to guides and research. Anywhere considered more reliable or particularly hard-hitting? ...
7
votes
3answers
259 views

How can I circumvent the lack of Java updates?

Just imagine you have a bunch of computers which need Java for some important software and you can't just switch to another vendor because all are using Java in this field of technology. If you start ...
1
vote
1answer
601 views

Windows Update - Interception

I'm trying to monitor the HTTP requests/responses made when performing a Windows Update. I have a Windows 8 machine configured with a proxy in IE. I've also imported via netsh for winhttp: netsh ...
1
vote
1answer
254 views

Padding oracle - Vulnerable Version of ASP.NET

I would like to install the vulnerable version of ASP.NET for testing purposes. I've thought about it and I guess the best way would be to delete/disable some security updates to make that possible. ...
0
votes
1answer
278 views

Best practice to manage user's java/browsers/flash player/adobe reader auto-update

We are specially concerned about if our users keep updating their browsers, flash player, adobe reader, java( feel free to let me know some others that are also important). These applications usually ...
0
votes
5answers
4k views

How to list missing security updates for Windows servers?

I have a list of applied security patches and updates, exported from Windows server 2003. The exported list is in CSV format, but converting it is not a problem for me. Is there any tool/site/script ...
3
votes
2answers
2k views

Using Window Servers 2003 after security updates are discontinued

Let's say that Microsoft has stopped supporting Windows Server 2003 now so there is no any security updates and I use that system for Domain Controller (Windows XP/7 Professional Clients) and File ...
3
votes
2answers
191 views

Are Windows Updates susceptible to tampering, eg. using a MiTM attack.

My real question is how are patches and updates authenticated in general. But for example how does windows know a windows update is really a windows update, does it just trust the URL or is there some ...
-1
votes
1answer
116 views

What was Microsoft trying to do when they had Windows Updates over their website? [closed]

What was Microsoft trying to do when they had Windows Updates over their website? Now it's completely integrated into the operating system and it seems much smoother. The Linux and Mac I've used got ...
-1
votes
1answer
93 views

How come FireFox came out with another release a week latter? Was a threat discovered? [closed]

I updated to FireFox 13 last week and today I got a message about there being a security update and upgrading to FireFox 14. Was a major security threat found? What justified the release of version 14 ...
2
votes
3answers
876 views

Is OpenSSL secure enough?

We plan in distribute Node.JS webservers, for their advantage of async I/O. The Node.JS https servers use OpenSSL libraries. It appears that OpenSSL has vulnerabilities resolved on a regular basis. ...
4
votes
1answer
430 views

CDNs used by Windows Update

My question is about CDNs (Content Delivery Networks) and their simultaneous use for legal and questionnable stuff. One specific example is the following. I'm noticing taffic from our network to the ...
0
votes
1answer
506 views

Mod_security rules-updater.pl fails to pull new release

Mod_security has a rules updater distributed with their release packages on sourceforge: http://sourceforge.net/projects/mod-security/files/modsecurity-crs/0-CURRENT/ Usually, you can run the script ...
12
votes
3answers
321 views

Android security without updates

I have an android phone which, like many others, has quickly become unsupported and is not receiving any updates. At the same time there are publicly available exploits for privilege-escalation ...
1
vote
1answer
428 views

Is there any way to use Nuget securely?

Visual Studio now includes a Package Manager that downloads and updates software packages from the internet. The common name for this is "Nuget" The problem I have is that anyone can pretend to be ...
5
votes
5answers
1k views

Where to download OpenBSD release ISO's over HTTPS?

OpenBSD claims to be highly secure. So why doesn't it allow downloading the release iso's over HTTPS? Or I'm missing something? Can someone please explain this to me?