I have several systems that require PCI compliance, all of them are running CentOS 6.4 with all security updates applied daily. However, PCI compliance scanning will often reject detected versions of external services (Apache, PHP, MySQL) that it deems to be insecure. The measurement of security is simply the version number of the software package--if that information is reported to the scanner vs. having all version information turned off to the outside world by defining a less verbose configuration.
I have a brand new CentOS 6.4 box that I am securing and it has failed it's initial PCI scan (no surprise there). But the first issue reported says: "PHP 5.3 < 5.3.7 Multiple Vulnerabilities." The server currently has PHP 5.3.3, as supplied by CentOS. There are other failing packages as well, but I'll focus on PHP for this question.
Some points to consider
- It's generally understood (I think) that Linux vendors claiming stability as a feature do not rush out every new version of a package released upstream, with an exception sometimes for web browsers/plugins.
- Vendors do release security updates, but not for every source release. (Example: PHP 5.3.26 is the newest in the 5.3 releases, and it claims to fix CVE-2013-2110.)
- Vendor packages sometimes leave the major.minor version number the same, but bump the release number with a security patch backported into their package for compatibility reasons. Therefore, it's possible a security issue has been fixed even if the version number doesn't suggest that. (PCI: This requires time consuming manual documentation to get a compliance override.)
- I have seen arguments in the past that vendor packages can be more secure, on the basis that they can include non-standard patches to the source. That is rarely documented in a way that can be easily reviewed, though.
- We roll our own packages to get newer releases of external services, such as PHP, updated quickly. It provides obscure bug fixes, too, which vendors are probably less concerned about.
To achieve PCI compliance, my experience shows that rolling custom packages is the only way to pass. We have used Security Metrics, Trust Wave, and Control Scan with various results. Does that mean vendor-supplied packages, including their security updates, are not enough because they lag too far behind the upstream releases?
Note: I am asking this question because I have seen plenty of "security advice" over time that recommends "Run yum upgrade daily to get your security updates," but a PCI scanner generally disagrees that enough effort has been made regarding the security of the installed versions.
