2

I'm new in linux admin and security approach, and need some tips about warnings from Debsecan scanner tool.

I have some warnings returned by simple check, like this below:

CVE-2017-1000158 python2.7-minimal (remotely exploitable, high urgency)
CVE-2016-2779 libsmartcols1 (high urgency)
CVE-2017-12618 libaprutil1-ldap (low urgency)

With that reference for example CVE-2017-12618 libaprutil1-ldap I search and find that page: https://security-tracker.debian.org/tracker/CVE-2017-12618

And I was in doubt on how to use this information to fix the warning?

From the table have the status of version package and respective version OS.

Source Package    Release            Version            Status
apr-util (PTS)    wheezy             1.4.1-3            vulnerable
                  wheezy (security)  1.4.1-3+deb7u1     fixed
                  jessie             1.5.4-1            vulnerable
                  stretch            1.5.4-3            vulnerable
                  buster, sid        1.6.1-1            fixed

I'm using Debian(stretch) and I don't know how see the version package installed and how change from fix package? This is the way?

  • I would install and configure unattended-upgrades instead: wiki.debian.org/UnattendedUpgrades – eckes Dec 6 '17 at 5:29
  • Tks for atention, i try unattended-upgrades with the dpkg-reconfigure -plow unattended-upgrades, the warnnings keep already, need some custom configuration? @eckes – MagicHat Dec 6 '17 at 11:31
  • Debian publishes.updstes together with the advisories. When you get vulnerabilitiy,reports despite you tried to,upgrade then you either miss the proper upgrade repositories, have packets pinned or your Debian distribution is no longer maintained or not yet maintained or Debian can or want no fixes. In the case of above tracker it says that no advisory is available for your distribution since it is a minor problem. In the current case Wheezy is fixed by the LTS team it seems. – eckes Dec 6 '17 at 19:23
  • @eckes As you can see i spend some days trying understand your point, i have a small problem (my english is poor, but i try better). I can see on the table from my question the status of respective OS, but ` don't know how see the version package installed(in my OS) and how change from fix package?` I my mind i think : replace vulnerable package from stable package no matter the OS... If is the way, how i do, if not, how is so? Sory if i confuse more and tks for atention... – MagicHat Dec 9 '17 at 11:59
  • Debian does not offer a fix for this minor problem in apr-util for your distribution, only for older generations (most likely because a different team is working on the older LTS version). You can use apt-cache policy apr-util to see versions and applicable update sources. I haven’t done enough checking if it is actually possible to use a version from a different Debian distribution but I would generally not do that until you are really sure the dependencies work out. – eckes Dec 9 '17 at 15:02
1

All known vulnerabilities in existing software almost certainly have patches and upgrades issued within hours of disclosure. The vulnerabilities can be fixed by updating to the newest versions available.

To update, issue these commands.

apt-get update && apt-get upgrade && apt-get dist-upgrade

This would automatically upgrade your softwares to the newest versions available.

  • Tks for atention, but is not answer the question, maybe im not cleary my point... Ok i try run updates and upgrades command, but the warnnings keep already,,, My question is if the way to fix warnnings is by the change vulnerable packages wtih fixed packages... I can change stretch 1.5.4-3 vulnerable(idk if is that version in my machine) by wheezy (security) 1.4.1-3+deb7u1 fixed? My doubt is , if that way to fix warrnnigs, when update and upgrades dont work? – MagicHat Dec 6 '17 at 10:26
  • No they don’t ,) – eckes Dec 6 '17 at 19:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.