Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [patching]

A patch is small program that updates another program, usually to fix a specific issue. Patches are also often called fixes.

2
votes
1answer
70 views

Avoiding the race condition between time of release and time of update

There is a kind of race condition between the time when a developer releases a security update and the time when the security update is actually applied by the user. In the meantime, an attacker will ...
2
votes
2answers
60 views

How do i know if my ubuntu apache version is secure?

I am running Ubuntu 16.04 LTS and checking dpkg -l apache2 gives me version 2.4.18-2ubuntu3.9. How do i know that 2ubuntu3.9 has the latest security patches listed here at https://httpd.apache.org/...
91
votes
5answers
20k views

How do services with high uptime apply patches without rebooting?

How are critical security updates installed on systems which you cannot afford to reboot but the update requires a reboot. For example, services/businesses that are required to run 24x7 with zero ...
4
votes
1answer
101 views

Can restarting a router result in its software being updated?

Articles in the past few days have mentioned the FBI recommending folks restarting their routers to avoid “Russian” malware from affecting some 500,000 routers. This made me curious; what could ...
1
vote
2answers
652 views

Pros and cons of installing security updates automatically?

I recently got into a discussion regarding automatic installation of security updates. The system is used and managed by a small nonprofit organization—essentially one or two admins managing the ...
0
votes
1answer
765 views

Has Microsoft released a patch for MS17-010?

Is there a patch or fix to safeguard against the MS17-010 (EternalSynergy + EternalRomance + EternalChampion) exploit yet?
1
vote
3answers
561 views

Why does metasploit still work?

Metasploit is publicly available as well as all the exploits and the vulnerabilities in its database. This means that a company can patch and secure its network and software accordingly to the ...
3
votes
1answer
400 views

Adobe Flash and Meltdown / Spectre

Many browsers have received updates to protect against the Meltdown and Spectre attacks. I presume these patches relate (solely) to JavaScript execution within the browser. Java in the browser is as ...
1
vote
1answer
71 views

Do vulnerability reports often get disregarded for lack of information?

I recently came across the following article. Tl;dr: a real vulnerability was disregarded, so the security researcher exploited the vulnerability to get attention from Facebook's security team. ...
4
votes
2answers
214 views

Will patching a higher layer protect against the spectre/meltdown vulnerability in a lower layer?

The question I am about to ask is similar to the following question: Do I need to patch Linux for Meltdown/Spectre if the hypervisor has been patched, and I trust the guest? However, I would like to ...
72
votes
8answers
12k views

If we are behind a firewall, do we still need to patch/fix vulnerabilities?

I have recently joined a security focused community in my organisation. Many of our products are deployed in the intranet (on-premise) nothing in the public cloud. So, the internal portals can be ...
0
votes
3answers
91 views

Is it recommended to patch announced vulnerability for unused services or features?

Sometimes vendors announce software upgrade to patch some discovered vulnerability in some feature or service which is not enabled in your system. Is it recommended to upgrade your software although ...
3
votes
2answers
369 views

How do I secure my home Wi-Fi network in light of KRACK? [duplicate]

Now that KRACK has been discovered to exploit WPA2, is it still possible to secure my home Wi-Fi network? If so, what steps should I take to secure it against KRACK attacks? Will there now be a need ...
0
votes
5answers
194 views

Are software vulnerabilities limitless?

Ok. I believe no one has thought of this perspective, so here goes. I really don't understand why software need to be constantly patch for security when programmers do a good and complete job in the ...
0
votes
1answer
88 views

Is the RHEL 7 version of FreeRadius not affected by RHSA-2017:1759 (or similar)?

In July 2017, multiple security issues have been found in FreeRadius 2.x.x and 3.0.x. RHEL 6 uses FreeRadius 2.x.x and Red Hat has released security advisory RHSA-2017:1759. However, for RHEL 7, no ...
1
vote
3answers
2k views

What is the difference between patch management and vulnerability management?

I've been thinking about this lately. are they the same thing? or is the latter has a lot more than just management of patches?
1
vote
1answer
708 views

Is an updated OS, in general, more secure than its predecessor?

I'm updating the OS on several servers before they run out of support. I'd like to say the new OS (Windows Server 2008 R2 to Windows Server 2016) is more secure because it includes all security ...
1
vote
2answers
193 views

Would it be possible and advisable to create a worm to patch for WannaCrypt?

WannaCrypt uses an SMB vulnerability to spread. Can we not use this vulnerability to create a similar worm, but one which patches for WannaCrypt instead of affecting it. Our worm infects a computer ...
4
votes
1answer
355 views

Windows 7 and missing patches and how to handle

With the ransomware scare, someone asked me to look at their computer to make sure they have the required patch. They had no patches after June 2016, with only the recent May 2017 patches installed. ...
2
votes
4answers
664 views

Is older software safer to use? [closed]

Is software (and even hardware) that is a few years old safer to use than something that's only been out for a few months? On GRC Security I remember the author cautioning against Windows 7 as it ...
3
votes
2answers
136 views

Methods of determining if a software bug is a security risk?

I don't really want to get into the specifics. I found a bug from a huge software provider. As any other responsible user, I have reported the bug to the software provider. It is hard to tell if ...
2
votes
1answer
90 views

Difference between virtual and full patching of vulnerabilities?

What is the difference between virtual patching and full patching of vulnerabilities?
7
votes
1answer
251 views

Is KernelCare kernel patching recognized as a valid method of patching kernels by 3rd party auditors and pen testers?

This is probably more of a compliance question, so if there is a better place to ask, please let me know. Background: It is a long complex story, but we can't easily update our linux kernels due to ...
3
votes
2answers
1k views

Does unpatched software comply with PCI DSS 3.1?

Can some one help me to confirm that unpatched software complies with PCI DSS 3.1 or not? The software developer has already released the security patches to fix the vulnerabilities but the ...
1
vote
1answer
131 views

Security code review

For an application that is hosted by a legacy server version which cannot be patched, could a periodic security centric application code review prevent potential exploitable vulnerabilities to the ...
2
votes
3answers
178 views

Did information technology had a increase or decrease in security with the introduction of automatic update features?

For obvious reasons we teach users Always update... updates are good... never forget updates, et cetera! Apart from the danger of malicious advertisements that make use of that showing users ...
3
votes
2answers
223 views

Does a virtualised Windows machine without internet access need (security) updates?

I recently saw a Windows 7 machine (virtually running in a Xen environment) and used in a production network to perform certain automated tasks. This system was missing over a 100+ Windows update ...
3
votes
2answers
157 views

How can I convey risks associated with out-of-support software?

Where or how can I find a list of only unpatched security exploits for an out-of-support operating system? I want to be sure I can inform server owners of the actual risks of staying on an obsolete OS....
2
votes
3answers
161 views

Is it safe to manually patch bugs on an outdated operating system such as Ubuntu 10.04?

How do I manually patch security bugs safely without damaging the system for information security purposes on my Ubuntu system that I am running on one of my mobile computers? I need to find packages ...
7
votes
2answers
396 views

How often do security patches break business applications [closed]

Are there any statistics on how reliable security patches are? Such as the fraction recalled or corrected? Part of keeping a computer secure is applying security patches to it. The period between a ...
63
votes
3answers
5k views

Are staggered roll outs of security patches bad?

Many Android devices, including the Google Nexus line, are now receiving monthly security patches via OTA updates, accompanied by the Android Security Bulletins. However, these updates are often ...
1
vote
1answer
843 views

Are Windows Superseding Patches not fully securing my systems?

I have completed a Nessus vulnerability scan of a Windows system. The scan is indicating that some windows patches are missing, but the patches are superseded patches and the most recent version of ...
2
votes
1answer
886 views

How to identify and patch a hardware vulnerability?

Software and systems vulnerabilities are often patched with updates, or by avoiding the use of some OS or softwares that have multiple flaws. Regarding hardware vulnerabilities, I do not have a lot of ...
1
vote
1answer
767 views

Do IIS / ASP.NET / MVC version headers reveal patch presence?

Quick question: does anyone know whether the IIS / ASP.NET / MVC version headers, like this: Server: Microsoft-IIS/8.5 X-AspNetMvc-Version: 5.2 X-AspNet-Version: 4.0.30319 can be used to determine ...
2
votes
1answer
83 views

How can I inspect/audit an Android phone if it's vulnerable to CVE-2012-4221 (or any other?)

I want to create a guide (or app) to audit devices and determine if the hardware or software is vulnerable to attack. Given an arbitrary phone, what process should I do to determine if outstanding ...
3
votes
1answer
664 views

Do major linux distributions differ with regard to releasing security patches? [closed]

For a non-commercial user, is there any difference between major distributions regarding the time needed for security patches to be available? Does the "enough eyeballs effect" takes places in this ...
3
votes
3answers
69 views

Java with LIS system

I'm not well versed in technology but have a problem that maybe you experts could answer. We have a software application that supports our laboratory - obviously must be secure. We want to be able to ...
10
votes
2answers
1k views

Why Can't Google Just Switch to Pushing Android Security Updates Directly to Users?

Okay, I'll just begin with the question and then elaborate a bit below. It is: Why has the world's dominant maker of non-Apple smartphone operating systems, Google, still not adopted a straight-to-...
2
votes
0answers
106 views

Does the Java version matter when compiling an Android, Amazon, or Blackberry app? (for security reasons)

I need to compile an app that will run on an Android, or Android compatible system (Android, Amazon Fire, or Blackberry). The developer documentation says that JDK 7 is needed, however there are ...
3
votes
1answer
625 views

Is the 'SUIDGuard' patch safe to implement?

Can someone who really knows what they're looking at advise whether the patch published here by Stefan Esser is in fact safe to install? While I'm very concerned that Apple haven't published an ...
3
votes
2answers
777 views

Where to check if a specific OS / service is vulnerable despite being patched, because of a vendor's decision?

I need to discuss how to mitigate the risk of services which are vulnerable despite being patched (typically because they are not maintained by the vendor anymore, or because the vendor does not want ...
3
votes
1answer
141 views

Is a newly installed server with no services running (but connected to the web) at risk?

A new server has just been installed but literally has nothing else running on it, no services setup to SSH in or anything yet (it's a Linux server). However, it is hooked up to the web so I can ...
3
votes
1answer
264 views

At what criteria should an unpatched machine be considered hacked? [closed]

Since every machine connected to the Internet requires security patches, there is a window of time in which those updates have been released and those machines haven't yet been patched. It is ...
2
votes
2answers
185 views

Should I update my openSSL package? [closed]

This link talks about the new patches to be released by OpenSSL Foundation very soon. It says: In a mailing list note published last night, Matt Caswell of the OpenSSL Project Team announced ...
0
votes
2answers
2k views

How frequently install patches in an enterprise environment?

We're trying to implement a patch schedule in our environment for both linux and windows systems. I'm curious to hear how often other enterprise companies are patching their servers so we can get an ...
3
votes
2answers
876 views

Is it possible to “fingerprint” the “patches” applied to a Windows system?

Two situations with a similar goal: 1) You have access to a target network, and you a Windows host. Is it possible to remotely finger print which (operating system security) patches are applied to ...
-5
votes
1answer
329 views

RC4 and Crypto Ransomware [closed]

If we allow no RC4 support on any devices, will Crypto Ransomware be slowed down or eliminated? Is this a patching and not a malware problem? Can we block this threat at the packet level?
3
votes
2answers
750 views

Microsoft recommended patching period - Security Patch release and updates

Ideally a security patch released by a vendor such as Microsoft for the Windows OS is required to be patched immediately. What would be the recommended patching period that Microsoft or best practices ...
1
vote
1answer
61 views

What account should be used to install SQL Server 2008 patches?

The company I work for is currently going undertaking a project to remediate (among other things) a pen-test finding that a privileged domain-level account (which was compromised by the pen-testers ...
2
votes
5answers
160 views

Beyond patching, how can I reduce the risk of browser exploits?

Keeping web browsers on the most up to date version and also the plugins that are used is pretty much all we do. Is there anything I else I can do to reduce the risk of browser exploits? The only ...