Questions tagged [patching]
A patch is small program that updates another program, usually to fix a specific issue. Patches are also often called fixes.
105
questions
1
vote
2
answers
91
views
How to reason about CVEs packaged in other open source software
I am reasoning about how to form a policy on CVEs found in software components that do not come from the software itself, but comes in a built-in dependency of that software.
Take the example of a ...
- 111
0
votes
1
answer
64
views
How exactly do security fixes get to the users in PHP?
I want to understand the process to go from a security bug report to a running system having the bug fix applied. Especially how long it takes from the bug being public until the bug is fixed on the ...
- 145
0
votes
1
answer
860
views
KB Patches not taking effect for CVE-2022-26832: .NET Framework Denial of Service Vulnerability
Rapid 7 has found CVE-2022-26832 on a server running Windows Server 2012 R2 Standard Edition with a French langauge pack installed.
The following is listed as the proof why Rapid 7 thinks the ...
17
votes
3
answers
3k
views
Patching operational technology products in a manufacturing assembly line?
I have recently moved to the manufacturing sector to take care of security of systems/products, specifically operational technology (OT) products. Based on a recent US CISA advisory, I had to apply a ...
4
votes
3
answers
7k
views
How secure is OpenCore Legacy Patcher?
My MacBookPro doesn't get major updates anymore, but the hardware still works well.
I came accross OpenCore Legacy Patcher, which allows to install recent versions of MacOs onto older macs through ...
- 141
1
vote
0
answers
414
views
Do anti-cheat software actually "patch" the UEFI firmware on your motherboard?
I've recently read about the new game called Bloodhunt containing an Anti-Cheat, which had a bug, in which the anti-cheat service would stay installed even though the game is removed. The top Steam ...
- 1,554
0
votes
2
answers
160
views
Importance of OS security patches for devices only used in home network
(This question bugs me because I am not willing to upgrade for Windows 10)
If we are talking about a device (i.e. a PC) in the following scenario:
The device is located behind a router that is up-to-...
- 1
1
vote
1
answer
243
views
Is VLC from the Ubuntu LTS official repository insecure?
Often it is impossible at first sight to understand if a package in a repository is up-to-date with security fixes, because the maintainers use a different naming when applying the patches to old ...
- 15.7k
0
votes
1
answer
160
views
Developer requests dev systems don't have .Net patches applied
Looking for some guidance on an internal discussion we're having.
We have a .Net developer that is requesting all development systems with Visual Studio installed don't have .Net updates installed. ...
- 1
1
vote
1
answer
160
views
What is the risk of using Windows Phone 8.1 now?
My friend uses Microsoft Phone 8.1 mobile for a tax accountancy firm. As it hasn't received security updates for five years I believe that is a significant information security risk. However, the ...
- 111
0
votes
1
answer
102
views
Do corporate systems need to be updated immediately after updates are available? [duplicate]
I lived under impression that timely updates were very important. Even a home user wouldn't like their computer to demand ransom for their data. However, the less home and the more corporate our ...
- 5,747
1
vote
1
answer
177
views
CVE-2020-5250 php vulnerability analysis
I am exploring the vulnerability (CVE-2020-5250) found in PrestaShop software versions <1.7.6.4. Could somebody explain how (with which method) was the program exactly exploitable? And why is the ...
- 11
0
votes
1
answer
164
views
CVE-2020-0601 (CRYPT32.DLL exploit) standalone patch? [duplicate]
Is there any standalone patch for CVE-2020-0601 (CRYPT32.DLL exploit) besides installing Windows 10 latest cumulative update?
Or is there other ways to mitigate this exploit, when immediate ...
- 1
5
votes
1
answer
3k
views
EKS managed worker nodes security patching
Do AWS EKS managed nodes receive security patching automatically or is it the owner's responsibility to patch?
- 53
5
votes
2
answers
2k
views
Does CVE-2020-0601 (CRYPT32.DLL critical exploit) affect Windows 7 and is there a patch to fix it?
I'm getting conflicting reports.
Search in Google: "windows 7" fix CVE-2020-0601
The top result (from PCWorld) claims that "contrary to earlier rumors, it does not affect Windows 7".
Scrolling down ...
- 420
1
vote
1
answer
425
views
vulnerability management, risk mitigation vs risk acceptance
I was involved in a conversation concerning the in-house vulnerability management program. One the statements made was that the management is generally not willing to accept risk and it should be ...
- 79
5
votes
3
answers
351
views
Fix vulnerabilities in ALL applications, or only client-facing ones?
Given a setup where we have nginx sat in a DMZ serving static content, forwarding (REST/WS) requests through a firewall to tomcat running on a server where other applications are also running:
YOU &...
- 151
0
votes
0
answers
110
views
How to check security and other updates avaliable on linux distro automaticaly?
Let suppose we have network of 10 plus Linux machines having different distro (debian, Centos , Redhat and Arch etc ).
Can we implement some centralized system where we have update about update on ...
- 111
2
votes
0
answers
182
views
Patch management for production servers
I'm trying to implement an automated patching program at a small SaaS provider.
When a customer signs up for our software, we provision them a Linux VM in our primary datacenter.
Each customer also ...
- 17
5
votes
1
answer
916
views
Is the most recent version of ojdbc7 still vulnerable to CVE-2016-3506?
Looking at the Oracle security advisory page here: https://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Oracle in 2016 disclosed vulnerabilites in their OJDBC7 versions 12.1.0....
- 51
2
votes
1
answer
362
views
Best practices for vulnerability patching periods?
I was wondering if there are any general recommendations on maximum resolution times for vulnerabilities.
Consider a vulnerability/patch management process where a ticket is opened when a ...
- 367
1
vote
1
answer
168
views
Patch Advisory Board - feasibility of implementation
I'm working for a public sector organisation (around 6000 staff) with a mixed IT skill set. We're looking at setting up a patch advisory board to assist in server patching.
The plan is to have a team ...
- 71
1
vote
1
answer
285
views
Backdooring PE binary compiled with ASLR
I'm practicing backdooring PE binary compiled with ASLR in a WOW64 environment. The approach is pretty straightforward and basically is something like this:
Find code cave and a hijacking point. In ...
- 171
1
vote
1
answer
323
views
Does SOC1/SOC2 mandate installing non Security related patches
I am looking at our patch management control for SQL Server databases and until now the process only requires us to install security patches. Microsoft releases cumulative updates every month and it ...
- 119
5
votes
2
answers
679
views
What are some examples of viruses/exploits with benevolent purposes?
A comment from another user had me thinking. What are some well-known (or perhaps not quite so) examples of in-the-wild "malicious" software that do nothing actually malicious, but instead takes ...
- 594
5
votes
3
answers
294
views
Avoiding the race condition between time of release and time of update
There is a kind of race condition between the time when a developer releases a security update and the time when the security update is actually applied by the user. In the meantime, an attacker will ...
- 15.7k
2
votes
2
answers
922
views
How do i know if my ubuntu apache version is secure?
I am running Ubuntu 16.04 LTS and checking dpkg -l apache2
gives me version 2.4.18-2ubuntu3.9.
How do i know that 2ubuntu3.9 has the latest security patches listed here at https://httpd.apache.org/...
- 911
97
votes
5
answers
24k
views
How do services with high uptime apply patches without rebooting?
How are critical security updates installed on systems which you cannot afford to reboot but the update requires a reboot. For example, services/businesses that are required to run 24x7 with zero ...
- 871
4
votes
1
answer
156
views
Can restarting a router result in its software being updated?
Articles in the past few days have mentioned the FBI recommending folks restarting their routers to avoid “Russian” malware from affecting some 500,000 routers.
This made me curious; what could ...
- 1,352
2
votes
2
answers
2k
views
Pros and cons of installing security updates automatically?
I recently got into a discussion regarding automatic installation of security updates. The system is used and managed by a small nonprofit organization—essentially one or two admins managing the ...
- 367
0
votes
1
answer
2k
views
Has Microsoft released a patch for MS17-010?
Is there a patch or fix to safeguard against the MS17-010 (EternalSynergy + EternalRomance + EternalChampion) exploit yet?
- 3
1
vote
2
answers
2k
views
Why does metasploit still work?
Metasploit is publicly available as well as all the exploits and the vulnerabilities in its database. This means that a company can patch and secure its network and software accordingly to the ...
- 39
3
votes
1
answer
480
views
Adobe Flash and Meltdown / Spectre
Many browsers have received updates to protect against the Meltdown and Spectre attacks. I presume these patches relate (solely) to JavaScript execution within the browser. Java in the browser is as ...
- 4,633
1
vote
1
answer
118
views
Do vulnerability reports often get disregarded for lack of information?
I recently came across the following article.
Tl;dr: a real vulnerability was disregarded, so the security researcher exploited the vulnerability to get attention from Facebook's security team.
...
- 203
4
votes
2
answers
345
views
Will patching a higher layer protect against the spectre/meltdown vulnerability in a lower layer?
The question I am about to ask is similar to the following question:
Do I need to patch Linux for Meltdown/Spectre if the hypervisor has been patched, and I trust the guest?
However, I would like to ...
- 141
76
votes
8
answers
14k
views
If we are behind a firewall, do we still need to patch/fix vulnerabilities?
I have recently joined a security focused community in my organisation. Many of our products are deployed in the intranet (on-premise) nothing in the public cloud. So, the internal portals can be ...
- 861
0
votes
3
answers
152
views
Is it recommended to patch announced vulnerability for unused services or features?
Sometimes vendors announce software upgrade to patch some discovered vulnerability in some feature or service which is not enabled in your system. Is it recommended to upgrade your software although ...
- 365
3
votes
2
answers
456
views
How do I secure my home Wi-Fi network in light of KRACK? [duplicate]
Now that KRACK has been discovered to exploit WPA2, is it still possible to secure my home Wi-Fi network? If so, what steps should I take to secure it against KRACK attacks? Will there now be a need ...
- 3,157
0
votes
5
answers
326
views
Are software vulnerabilities limitless?
Ok. I believe no one has thought of this perspective, so here goes.
I really don't understand why software need to be constantly patch for security when programmers do a good and complete job in the ...
- 113
0
votes
1
answer
141
views
Is the RHEL 7 version of FreeRadius not affected by RHSA-2017:1759 (or similar)?
In July 2017, multiple security issues have been found in FreeRadius 2.x.x and 3.0.x. RHEL 6 uses FreeRadius 2.x.x and Red Hat has released security advisory RHSA-2017:1759. However, for RHEL 7, no ...
- 415
1
vote
3
answers
4k
views
What is the difference between patch management and vulnerability management?
I've been thinking about this lately. are they the same thing? or is the latter has a lot more than just management of patches?
- 281
1
vote
1
answer
788
views
Is an updated OS, in general, more secure than its predecessor?
I'm updating the OS on several servers before they run out of support. I'd like to say the new OS (Windows Server 2008 R2 to Windows Server 2016) is more secure because it includes all security ...
- 153
1
vote
2
answers
257
views
Would it be possible and advisable to create a worm to patch for WannaCrypt?
WannaCrypt uses an SMB vulnerability to spread. Can we not use this vulnerability to create a similar worm, but one which patches for WannaCrypt instead of affecting it.
Our worm infects a computer ...
- 123
3
votes
1
answer
507
views
Windows 7 and missing patches and how to handle
With the ransomware scare, someone asked me to look at their computer to make sure they have the required patch. They had no patches after June 2016, with only the recent May 2017 patches installed. ...
- 61
2
votes
4
answers
984
views
Is older software safer to use? [closed]
Is software (and even hardware) that is a few years old safer to use than something that's only been out for a few months?
On GRC Security I remember the author cautioning against Windows 7 as it ...
- 283
2
votes
2
answers
220
views
Methods of determining if a software bug is a security risk?
I don't really want to get into the specifics.
I found a bug from a huge software provider. As any other responsible user, I have reported the bug to the software provider.
It is hard to tell if ...
- 1,290
2
votes
1
answer
157
views
Difference between virtual and full patching of vulnerabilities?
What is the difference between virtual patching and full patching of vulnerabilities?
7
votes
1
answer
512
views
Is KernelCare kernel patching recognized as a valid method of patching kernels by 3rd party auditors and pen testers?
This is probably more of a compliance question, so if there is a better place to ask, please let me know.
Background:
It is a long complex story, but we can't easily update our linux kernels due to ...
- 181
2
votes
2
answers
3k
views
Does unpatched software comply with PCI DSS 3.1?
Can some one help me to confirm that unpatched software complies with PCI DSS 3.1 or not?
The software developer has already released the security patches to fix the vulnerabilities but the ...
- 293
1
vote
1
answer
214
views
Security code review
For an application that is hosted by a legacy server version which cannot be patched, could a periodic security centric application code review prevent potential exploitable vulnerabilities to the ...
- 41