Questions tagged [patching]

A patch is small program that updates another program, usually to fix a specific issue. Patches are also often called fixes.

Filter by
Sorted by
Tagged with
17 votes
3 answers
3k views

Patching operational technology products in a manufacturing assembly line?

I have recently moved to the manufacturing sector to take care of security of systems/products, specifically operational technology (OT) products. Based on a recent US CISA advisory, I had to apply a ...
user avatar
0 votes
0 answers
478 views

How secure is OpenCore Legacy Patcher?

My MacBookPro doesn't get major updates anymore, but the hardware still works well. I came accross OpenCore Legacy Patcher, which allows to install recent versions of MacOs onto older macs through ...
user avatar
  • 101
1 vote
0 answers
175 views

Do anti-cheat software actually "patch" the UEFI firmware on your motherboard?

I've recently read about the new game called Bloodhunt containing an Anti-Cheat, which had a bug, in which the anti-cheat service would stay installed even though the game is removed. The top Steam ...
user avatar
0 votes
2 answers
137 views

Importance of OS security patches for devices only used in home network

(This question bugs me because I am not willing to upgrade for Windows 10) If we are talking about a device (i.e. a PC) in the following scenario: The device is located behind a router that is up-to-...
user avatar
  • 1
1 vote
1 answer
182 views

Is VLC from the Ubuntu LTS official repository insecure?

Often it is impossible at first sight to understand if a package in a repository is up-to-date with security fixes, because the maintainers use a different naming when applying the patches to old ...
user avatar
  • 15.3k
0 votes
1 answer
143 views

Developer requests dev systems don't have .Net patches applied

Looking for some guidance on an internal discussion we're having. We have a .Net developer that is requesting all development systems with Visual Studio installed don't have .Net updates installed. ...
user avatar
  • 1
1 vote
1 answer
116 views

What is the risk of using Windows Phone 8.1 now?

My friend uses Microsoft Phone 8.1 mobile for a tax accountancy firm. As it hasn't received security updates for five years I believe that is a significant information security risk. However, the ...
user avatar
0 votes
1 answer
89 views

Do corporate systems need to be updated immediately after updates are available? [duplicate]

I lived under impression that timely updates were very important. Even a home user wouldn't like their computer to demand ransom for their data. However, the less home and the more corporate our ...
user avatar
  • 5,587
1 vote
1 answer
151 views

CVE-2020-5250 php vulnerability analysis

I am exploring the vulnerability (CVE-2020-5250) found in PrestaShop software versions <1.7.6.4. Could somebody explain how (with which method) was the program exactly exploitable? And why is the ...
user avatar
0 votes
1 answer
153 views

CVE-2020-0601 (CRYPT32.DLL exploit) standalone patch? [duplicate]

Is there any standalone patch for CVE-2020-0601 (CRYPT32.DLL exploit) besides installing Windows 10 latest cumulative update? Or is there other ways to mitigate this exploit, when immediate ...
user avatar
2 votes
1 answer
1k views

EKS managed worker nodes security patching

Do AWS EKS managed nodes receive security patching automatically or is it the owner's responsibility to patch?
user avatar
  • 23
5 votes
2 answers
2k views

Does CVE-2020-0601 (CRYPT32.DLL critical exploit) affect Windows 7 and is there a patch to fix it?

I'm getting conflicting reports. Search in Google: "windows 7" fix CVE-2020-0601 The top result (from PCWorld) claims that "contrary to earlier rumors, it does not affect Windows 7". Scrolling down ...
user avatar
1 vote
1 answer
336 views

vulnerability management, risk mitigation vs risk acceptance

I was involved in a conversation concerning the in-house vulnerability management program. One the statements made was that the management is generally not willing to accept risk and it should be ...
user avatar
5 votes
3 answers
317 views

Fix vulnerabilities in ALL applications, or only client-facing ones?

Given a setup where we have nginx sat in a DMZ serving static content, forwarding (REST/WS) requests through a firewall to tomcat running on a server where other applications are also running: YOU &...
user avatar
  • 151
0 votes
0 answers
103 views

How to check security and other updates avaliable on linux distro automaticaly?

Let suppose we have network of 10 plus Linux machines having different distro (debian, Centos , Redhat and Arch etc ). Can we implement some centralized system where we have update about update on ...
user avatar
2 votes
0 answers
131 views

Patch management for production servers

I'm trying to implement an automated patching program at a small SaaS provider. When a customer signs up for our software, we provision them a Linux VM in our primary datacenter. Each customer also ...
user avatar
  • 17
4 votes
1 answer
747 views

Is the most recent version of ojdbc7 still vulnerable to CVE-2016-3506?

Looking at the Oracle security advisory page here: https://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Oracle in 2016 disclosed vulnerabilites in their OJDBC7 versions 12.1.0....
user avatar
  • 41
2 votes
1 answer
194 views

Best practices for vulnerability patching periods?

I was wondering if there are any general recommendations on maximum resolution times for vulnerabilities. Consider a vulnerability/patch management process where a ticket is opened when a ...
user avatar
1 vote
1 answer
135 views

Patch Advisory Board - feasibility of implementation

I'm working for a public sector organisation (around 6000 staff) with a mixed IT skill set. We're looking at setting up a patch advisory board to assist in server patching. The plan is to have a team ...
user avatar
  • 71
1 vote
1 answer
235 views

Backdooring PE binary compiled with ASLR

I'm practicing backdooring PE binary compiled with ASLR in a WOW64 environment. The approach is pretty straightforward and basically is something like this: Find code cave and a hijacking point. In ...
user avatar
  • 171
1 vote
1 answer
228 views

Does SOC1/SOC2 mandate installing non Security related patches

I am looking at our patch management control for SQL Server databases and until now the process only requires us to install security patches. Microsoft releases cumulative updates every month and it ...
user avatar
  • 119
5 votes
2 answers
557 views

What are some examples of viruses/exploits with benevolent purposes?

A comment from another user had me thinking. What are some well-known (or perhaps not quite so) examples of in-the-wild "malicious" software that do nothing actually malicious, but instead takes ...
user avatar
  • 594
5 votes
3 answers
243 views

Avoiding the race condition between time of release and time of update

There is a kind of race condition between the time when a developer releases a security update and the time when the security update is actually applied by the user. In the meantime, an attacker will ...
user avatar
  • 15.3k
2 votes
2 answers
677 views

How do i know if my ubuntu apache version is secure?

I am running Ubuntu 16.04 LTS and checking dpkg -l apache2 gives me version 2.4.18-2ubuntu3.9. How do i know that 2ubuntu3.9 has the latest security patches listed here at https://httpd.apache.org/...
user avatar
  • 901
95 votes
5 answers
24k views

How do services with high uptime apply patches without rebooting?

How are critical security updates installed on systems which you cannot afford to reboot but the update requires a reboot. For example, services/businesses that are required to run 24x7 with zero ...
user avatar
4 votes
1 answer
145 views

Can restarting a router result in its software being updated?

Articles in the past few days have mentioned the FBI recommending folks restarting their routers to avoid “Russian” malware from affecting some 500,000 routers. This made me curious; what could ...
user avatar
  • 1,332
2 votes
2 answers
2k views

Pros and cons of installing security updates automatically?

I recently got into a discussion regarding automatic installation of security updates. The system is used and managed by a small nonprofit organization—essentially one or two admins managing the ...
user avatar
0 votes
1 answer
2k views

Has Microsoft released a patch for MS17-010?

Is there a patch or fix to safeguard against the MS17-010 (EternalSynergy + EternalRomance + EternalChampion) exploit yet?
user avatar
1 vote
2 answers
2k views

Why does metasploit still work?

Metasploit is publicly available as well as all the exploits and the vulnerabilities in its database. This means that a company can patch and secure its network and software accordingly to the ...
user avatar
3 votes
1 answer
472 views

Adobe Flash and Meltdown / Spectre

Many browsers have received updates to protect against the Meltdown and Spectre attacks. I presume these patches relate (solely) to JavaScript execution within the browser. Java in the browser is as ...
user avatar
1 vote
1 answer
111 views

Do vulnerability reports often get disregarded for lack of information?

I recently came across the following article. Tl;dr: a real vulnerability was disregarded, so the security researcher exploited the vulnerability to get attention from Facebook's security team. ...
user avatar
  • 203
4 votes
2 answers
336 views

Will patching a higher layer protect against the spectre/meltdown vulnerability in a lower layer?

The question I am about to ask is similar to the following question: Do I need to patch Linux for Meltdown/Spectre if the hypervisor has been patched, and I trust the guest? However, I would like to ...
user avatar
75 votes
8 answers
14k views

If we are behind a firewall, do we still need to patch/fix vulnerabilities?

I have recently joined a security focused community in my organisation. Many of our products are deployed in the intranet (on-premise) nothing in the public cloud. So, the internal portals can be ...
user avatar
  • 851
0 votes
3 answers
131 views

Is it recommended to patch announced vulnerability for unused services or features?

Sometimes vendors announce software upgrade to patch some discovered vulnerability in some feature or service which is not enabled in your system. Is it recommended to upgrade your software although ...
user avatar
  • 333
3 votes
2 answers
437 views

How do I secure my home Wi-Fi network in light of KRACK? [duplicate]

Now that KRACK has been discovered to exploit WPA2, is it still possible to secure my home Wi-Fi network? If so, what steps should I take to secure it against KRACK attacks? Will there now be a need ...
user avatar
  • 3,147
0 votes
5 answers
291 views

Are software vulnerabilities limitless?

Ok. I believe no one has thought of this perspective, so here goes. I really don't understand why software need to be constantly patch for security when programmers do a good and complete job in the ...
user avatar
  • 113
0 votes
1 answer
136 views

Is the RHEL 7 version of FreeRadius not affected by RHSA-2017:1759 (or similar)?

In July 2017, multiple security issues have been found in FreeRadius 2.x.x and 3.0.x. RHEL 6 uses FreeRadius 2.x.x and Red Hat has released security advisory RHSA-2017:1759. However, for RHEL 7, no ...
user avatar
  • 415
1 vote
3 answers
4k views

What is the difference between patch management and vulnerability management?

I've been thinking about this lately. are they the same thing? or is the latter has a lot more than just management of patches?
user avatar
  • 271
1 vote
1 answer
775 views

Is an updated OS, in general, more secure than its predecessor?

I'm updating the OS on several servers before they run out of support. I'd like to say the new OS (Windows Server 2008 R2 to Windows Server 2016) is more secure because it includes all security ...
user avatar
  • 153
1 vote
2 answers
245 views

Would it be possible and advisable to create a worm to patch for WannaCrypt?

WannaCrypt uses an SMB vulnerability to spread. Can we not use this vulnerability to create a similar worm, but one which patches for WannaCrypt instead of affecting it. Our worm infects a computer ...
user avatar
3 votes
1 answer
493 views

Windows 7 and missing patches and how to handle

With the ransomware scare, someone asked me to look at their computer to make sure they have the required patch. They had no patches after June 2016, with only the recent May 2017 patches installed. ...
user avatar
  • 61
2 votes
4 answers
916 views

Is older software safer to use? [closed]

Is software (and even hardware) that is a few years old safer to use than something that's only been out for a few months? On GRC Security I remember the author cautioning against Windows 7 as it ...
user avatar
2 votes
2 answers
192 views

Methods of determining if a software bug is a security risk?

I don't really want to get into the specifics. I found a bug from a huge software provider. As any other responsible user, I have reported the bug to the software provider. It is hard to tell if ...
user avatar
  • 1,270
2 votes
1 answer
148 views

Difference between virtual and full patching of vulnerabilities?

What is the difference between virtual patching and full patching of vulnerabilities?
user avatar
7 votes
1 answer
491 views

Is KernelCare kernel patching recognized as a valid method of patching kernels by 3rd party auditors and pen testers?

This is probably more of a compliance question, so if there is a better place to ask, please let me know. Background: It is a long complex story, but we can't easily update our linux kernels due to ...
user avatar
  • 181
2 votes
2 answers
3k views

Does unpatched software comply with PCI DSS 3.1?

Can some one help me to confirm that unpatched software complies with PCI DSS 3.1 or not? The software developer has already released the security patches to fix the vulnerabilities but the ...
user avatar
  • 293
1 vote
1 answer
198 views

Security code review

For an application that is hosted by a legacy server version which cannot be patched, could a periodic security centric application code review prevent potential exploitable vulnerabilities to the ...
user avatar
3 votes
3 answers
260 views

Did information technology had a increase or decrease in security with the introduction of automatic update features?

For obvious reasons we teach users Always update... updates are good... never forget updates, et cetera! Apart from the danger of malicious advertisements that make use of that showing users ...
user avatar
  • 6,200
4 votes
2 answers
294 views

Does a virtualised Windows machine without internet access need (security) updates?

I recently saw a Windows 7 machine (virtually running in a Xen environment) and used in a production network to perform certain automated tasks. This system was missing over a 100+ Windows update ...
user avatar
  • 6,200
3 votes
2 answers
200 views

How can I convey risks associated with out-of-support software?

Where or how can I find a list of only unpatched security exploits for an out-of-support operating system? I want to be sure I can inform server owners of the actual risks of staying on an obsolete OS....
user avatar
  • 133