I just saw that my hoster is running extremly old modules on Apache.

The cURL Version is 3 years old, the SQLLite is from the 24th October 2014 and the zlib version is 1.2.8 instead of 1.2.11. Also, they are running a LibPNG Version 1.2.50 (released I think in 2012 that contains a lot of CVEs).

I told them what I found and they answered that they are doing this sucessfully for 15 years and I shouldn't annoy them.

  • 2
    Yes, any old unpatched software presents a risk. If you think that risk is high and they aren't concerned about it then you should probably find another host. Solely on their response to you when you reported it, I'd leave them. – iainpb Oct 1 '17 at 10:00
  • Change hosting cia. Period – jmingov Oct 1 '17 at 11:28
  • 1
    None of the products you mention are apache modules (but are linked in, e.g. mod_php)? – symcbean Oct 1 '17 at 23:00
  • 2
    You could search the National Vulnerability Database - nvd.nist.gov/vuln/search - to see if there's any vulnerabilities you care about, but in general, hosting providers should be up to date and patched and it is a red flag that they are not. They MAY be picking and choosing updates and ensuring they get security patches, but it is more likely they just don't patch. – crovers Oct 2 '17 at 17:34
  • 3
    Are you looking at versions/dates in the program files or the versions of the installed packages? Debian backports security fixes so the package for ABC version 1.2.3 doesn't contain the vulnerabilities that upstream ABC version 1.2.3 had. – dave_thompson_085 Oct 3 '17 at 4:38

From security perspective the old modules which is patched for all discovered vulnerabilities will be more secure than the new one's which is may be have many undiscovered vulnerabilities

| improve this answer | |
  • 3
    I don't think that is a very helpful distinction. An old system that has had patches in the past is not inherently more secure than a new system that has yet to be patched. What is more important in both cases is the level of activity and proactivness on the part of the maintainers. – Conor Mancone Oct 2 '17 at 23:59
  • Logic error: 'undiscovered vulnerabilities' exist universally - just because some vulnerabilities have been discovered does not mean a reduction in the possible number of vulnerabilities left undiscovered. This is known as a form of the Gambler's Fallacy. – schroeder Nov 4 '17 at 11:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.