3

Where or how can I find a list of only unpatched security exploits for an out-of-support operating system? I want to be sure I can inform server owners of the actual risks of staying on an obsolete OS. I can get a list of all CVEs, but I have been unable to filter for patch status.

  • Can you filter by date? It might not be an all-inclusive list then, but it's a start. – Iszi Jul 5 '16 at 19:33
  • Cve details does not let you filter by date after the end of life, if I could find a database that does it would be helpful – Eric Jul 5 '16 at 20:19
1

Typically, what I do is run a Vulnerability scan on the machine. That covers more than just the unpatchable exploits and can get into things like lack of support for newer protocols or newer crypto standards.

A scan will show the list of exploits specific to that machine as well as the other weaknesses that it might be subject to.

In addition, a scanner will rank the severity of the risks, which will make it easier to communicate to stakeholders.

I know that you were asking for a database before, but a scanner contains this database, and it filters it for the specific target.

1

CVE Details states there were 414 vulnerabilities reported with 98 patches. Be advised a service pack may have fixed many vulnerabilities so the numbers are not indicative of Windows 2003 still containing 316 vulnerabilities (414-98). This also could never include zero days, nor third party vulnerabilities (e.g., Adobe, JAVA, etc)

  • note that the question has been made more general – schroeder Jul 6 '16 at 14:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.