Are Windows Superseding Patches not fully securing my systems?

Question

I have completed a Nessus vulnerability scan of a Windows system. The scan is indicating that some windows patches are missing, but the patches are superseded patches and the most recent version of the patch is installed. I researched the two patches and the older patch is superseded by a cumulative patch and the old one is not available. The Nessus report has offered a registry fix that does remove it from the scan.

I can see two scenarios here (and possibility missing more):

• Windows is releases fixes to patches that are not fully fixing problems
• Nessus is enumerating the patch list and is reporting the patch as an audit concern and not a security concern.

I am wondering should I be proceeding with the fixes for system hardening or can I take the easier route (in my case) and document that the finding is not a security concern.

Answer 1

When doing patch enumeration, Nessus looks at the installed patch list and only understands patches that are in its database. If the rollup patches which supersede the original patches are relatively new, then Nessus may see that the old ones are not applied without knowing that there's a rollup in place, and may falsely report that the original patches are missing. When you apply the registry fix, Nessus identifies you as no longer vulnerable because you've applied a workaround that it detects is applicable.

Your first step here is to update your Nessus plugins to ensure they're current. This will help avoid this kind of problem, but Nessus will always be a short while behind the patch cycle on these.

Your second step should be to check which module reported the issues. If you're doing an authenticated or local scan and it's the patch plugin which reported them, then Nessus is simply failing to pick up the rollup patch. Verify that the patch is included in the rollup (which it looks like you have) and don't worry about it - it's a false positive. However, if you're doing a remote scan and the plugin which discovered it did so via the network (e.g. TCP port 123 has vuln xyz) then the vulnerability may well be present, and you should do further research.