Questions tagged [patching]

A patch is small program that updates another program, usually to fix a specific issue. Patches are also often called fixes.

Filter by
Sorted by
Tagged with
0
votes
0answers
52 views

How to check security and other updates avaliable on linux distro automaticaly?

Let suppose we have network of 10 plus Linux machines having different distro (debian, Centos , Redhat and Arch etc ). Can we implement some centralized system where we have update about update on ...
2
votes
0answers
52 views

Patch management for production servers

I'm trying to implement an automated patching program at a small SaaS provider. When a customer signs up for our software, we provision them a Linux VM in our primary datacenter. Each customer also ...
1
vote
1answer
43 views

Is the most recent version of ojdbc7 still vulnerable to CVE-2016-3506?

Looking at the Oracle security advisory page here: https://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Oracle in 2016 disclosed vulnerabilites in their OJDBC7 versions 12.1.0....
2
votes
1answer
56 views

Best practices for vulnerability patching periods?

I was wondering if there are any general recommendations on maximum resolution times for vulnerabilities. Consider a vulnerability/patch management process where a ticket is opened when a ...
0
votes
1answer
49 views

Patch Advisory Board - feasibility of implementation

I'm working for a public sector organisation (around 6000 staff) with a mixed IT skill set. We're looking at setting up a patch advisory board to assist in server patching. The plan is to have a team ...
1
vote
1answer
74 views

Backdooring PE binary compiled with ASLR

I'm practicing backdooring PE binary compiled with ASLR in a WOW64 environment. The approach is pretty straightforward and basically is something like this: Find code cave and a hijacking point. In ...
1
vote
1answer
59 views

Does SOC1/SOC2 mandate installing non Security related patches

I am looking at our patch management control for SQL Server databases and until now the process only requires us to install Security patches. Microsoft releases Cumulative updates every month and it ...
4
votes
2answers
238 views

What are some examples of viruses/exploits with benevolent purposes?

A comment from another user had me thinking. What are some well-known (or perhaps not quite so) examples of in-the-wild "malicious" software that do nothing actually malicious, but instead takes ...
5
votes
3answers
157 views

Avoiding the race condition between time of release and time of update

There is a kind of race condition between the time when a developer releases a security update and the time when the security update is actually applied by the user. In the meantime, an attacker will ...
2
votes
2answers
127 views

How do i know if my ubuntu apache version is secure?

I am running Ubuntu 16.04 LTS and checking dpkg -l apache2 gives me version 2.4.18-2ubuntu3.9. How do i know that 2ubuntu3.9 has the latest security patches listed here at https://httpd.apache.org/...
91
votes
5answers
21k views

How do services with high uptime apply patches without rebooting?

How are critical security updates installed on systems which you cannot afford to reboot but the update requires a reboot. For example, services/businesses that are required to run 24x7 with zero ...
4
votes
1answer
104 views

Can restarting a router result in its software being updated?

Articles in the past few days have mentioned the FBI recommending folks restarting their routers to avoid “Russian” malware from affecting some 500,000 routers. This made me curious; what could ...
2
votes
2answers
947 views

Pros and cons of installing security updates automatically?

I recently got into a discussion regarding automatic installation of security updates. The system is used and managed by a small nonprofit organization—essentially one or two admins managing the ...
0
votes
1answer
1k views

Has Microsoft released a patch for MS17-010?

Is there a patch or fix to safeguard against the MS17-010 (EternalSynergy + EternalRomance + EternalChampion) exploit yet?
1
vote
2answers
805 views

Why does metasploit still work?

Metasploit is publicly available as well as all the exploits and the vulnerabilities in its database. This means that a company can patch and secure its network and software accordingly to the ...
3
votes
1answer
411 views

Adobe Flash and Meltdown / Spectre

Many browsers have received updates to protect against the Meltdown and Spectre attacks. I presume these patches relate (solely) to JavaScript execution within the browser. Java in the browser is as ...
1
vote
1answer
74 views

Do vulnerability reports often get disregarded for lack of information?

I recently came across the following article. Tl;dr: a real vulnerability was disregarded, so the security researcher exploited the vulnerability to get attention from Facebook's security team. ...
4
votes
2answers
240 views

Will patching a higher layer protect against the spectre/meltdown vulnerability in a lower layer?

The question I am about to ask is similar to the following question: Do I need to patch Linux for Meltdown/Spectre if the hypervisor has been patched, and I trust the guest? However, I would like to ...
72
votes
8answers
13k views

If we are behind a firewall, do we still need to patch/fix vulnerabilities?

I have recently joined a security focused community in my organisation. Many of our products are deployed in the intranet (on-premise) nothing in the public cloud. So, the internal portals can be ...
0
votes
3answers
93 views

Is it recommended to patch announced vulnerability for unused services or features?

Sometimes vendors announce software upgrade to patch some discovered vulnerability in some feature or service which is not enabled in your system. Is it recommended to upgrade your software although ...
3
votes
2answers
379 views

How do I secure my home Wi-Fi network in light of KRACK? [duplicate]

Now that KRACK has been discovered to exploit WPA2, is it still possible to secure my home Wi-Fi network? If so, what steps should I take to secure it against KRACK attacks? Will there now be a need ...
0
votes
5answers
209 views

Are software vulnerabilities limitless?

Ok. I believe no one has thought of this perspective, so here goes. I really don't understand why software need to be constantly patch for security when programmers do a good and complete job in the ...
0
votes
1answer
95 views

Is the RHEL 7 version of FreeRadius not affected by RHSA-2017:1759 (or similar)?

In July 2017, multiple security issues have been found in FreeRadius 2.x.x and 3.0.x. RHEL 6 uses FreeRadius 2.x.x and Red Hat has released security advisory RHSA-2017:1759. However, for RHEL 7, no ...
1
vote
3answers
3k views

What is the difference between patch management and vulnerability management?

I've been thinking about this lately. are they the same thing? or is the latter has a lot more than just management of patches?
1
vote
1answer
711 views

Is an updated OS, in general, more secure than its predecessor?

I'm updating the OS on several servers before they run out of support. I'd like to say the new OS (Windows Server 2008 R2 to Windows Server 2016) is more secure because it includes all security ...
1
vote
2answers
198 views

Would it be possible and advisable to create a worm to patch for WannaCrypt?

WannaCrypt uses an SMB vulnerability to spread. Can we not use this vulnerability to create a similar worm, but one which patches for WannaCrypt instead of affecting it. Our worm infects a computer ...
3
votes
1answer
397 views

Windows 7 and missing patches and how to handle

With the ransomware scare, someone asked me to look at their computer to make sure they have the required patch. They had no patches after June 2016, with only the recent May 2017 patches installed. ...
2
votes
4answers
763 views

Is older software safer to use? [closed]

Is software (and even hardware) that is a few years old safer to use than something that's only been out for a few months? On GRC Security I remember the author cautioning against Windows 7 as it ...
2
votes
2answers
138 views

Methods of determining if a software bug is a security risk?

I don't really want to get into the specifics. I found a bug from a huge software provider. As any other responsible user, I have reported the bug to the software provider. It is hard to tell if ...
2
votes
1answer
94 views

Difference between virtual and full patching of vulnerabilities?

What is the difference between virtual patching and full patching of vulnerabilities?
6
votes
1answer
309 views

Is KernelCare kernel patching recognized as a valid method of patching kernels by 3rd party auditors and pen testers?

This is probably more of a compliance question, so if there is a better place to ask, please let me know. Background: It is a long complex story, but we can't easily update our linux kernels due to ...
2
votes
2answers
2k views

Does unpatched software comply with PCI DSS 3.1?

Can some one help me to confirm that unpatched software complies with PCI DSS 3.1 or not? The software developer has already released the security patches to fix the vulnerabilities but the ...
1
vote
1answer
140 views

Security code review

For an application that is hosted by a legacy server version which cannot be patched, could a periodic security centric application code review prevent potential exploitable vulnerabilities to the ...
2
votes
3answers
183 views

Did information technology had a increase or decrease in security with the introduction of automatic update features?

For obvious reasons we teach users Always update... updates are good... never forget updates, et cetera! Apart from the danger of malicious advertisements that make use of that showing users ...
3
votes
2answers
230 views

Does a virtualised Windows machine without internet access need (security) updates?

I recently saw a Windows 7 machine (virtually running in a Xen environment) and used in a production network to perform certain automated tasks. This system was missing over a 100+ Windows update ...
3
votes
2answers
162 views

How can I convey risks associated with out-of-support software?

Where or how can I find a list of only unpatched security exploits for an out-of-support operating system? I want to be sure I can inform server owners of the actual risks of staying on an obsolete OS....
2
votes
3answers
163 views

Is it safe to manually patch bugs on an outdated operating system such as Ubuntu 10.04?

How do I manually patch security bugs safely without damaging the system for information security purposes on my Ubuntu system that I am running on one of my mobile computers? I need to find packages ...
7
votes
2answers
483 views

How often do security patches break business applications [closed]

Are there any statistics on how reliable security patches are? Such as the fraction recalled or corrected? Part of keeping a computer secure is applying security patches to it. The period between a ...
63
votes
3answers
5k views

Are staggered roll outs of security patches bad?

Many Android devices, including the Google Nexus line, are now receiving monthly security patches via OTA updates, accompanied by the Android Security Bulletins. However, these updates are often ...
1
vote
1answer
953 views

Are Windows Superseding Patches not fully securing my systems?

I have completed a Nessus vulnerability scan of a Windows system. The scan is indicating that some windows patches are missing, but the patches are superseded patches and the most recent version of ...
2
votes
1answer
1k views

How to identify and patch a hardware vulnerability?

Software and systems vulnerabilities are often patched with updates, or by avoiding the use of some OS or softwares that have multiple flaws. Regarding hardware vulnerabilities, I do not have a lot of ...
1
vote
1answer
894 views

Do IIS / ASP.NET / MVC version headers reveal patch presence?

Quick question: does anyone know whether the IIS / ASP.NET / MVC version headers, like this: Server: Microsoft-IIS/8.5 X-AspNetMvc-Version: 5.2 X-AspNet-Version: 4.0.30319 can be used to determine ...
2
votes
1answer
83 views

How can I inspect/audit an Android phone if it's vulnerable to CVE-2012-4221 (or any other?)

I want to create a guide (or app) to audit devices and determine if the hardware or software is vulnerable to attack. Given an arbitrary phone, what process should I do to determine if outstanding ...
3
votes
1answer
742 views

Do major linux distributions differ with regard to releasing security patches? [closed]

For a non-commercial user, is there any difference between major distributions regarding the time needed for security patches to be available? Does the "enough eyeballs effect" takes places in this ...
3
votes
3answers
72 views

Java with LIS system

I'm not well versed in technology but have a problem that maybe you experts could answer. We have a software application that supports our laboratory - obviously must be secure. We want to be able to ...
10
votes
2answers
1k views

Why Can't Google Just Switch to Pushing Android Security Updates Directly to Users?

Okay, I'll just begin with the question and then elaborate a bit below. It is: Why has the world's dominant maker of non-Apple smartphone operating systems, Google, still not adopted a straight-to-...
2
votes
0answers
108 views

Does the Java version matter when compiling an Android, Amazon, or Blackberry app? (for security reasons)

I need to compile an app that will run on an Android, or Android compatible system (Android, Amazon Fire, or Blackberry). The developer documentation says that JDK 7 is needed, however there are ...
3
votes
1answer
625 views

Is the 'SUIDGuard' patch safe to implement?

Can someone who really knows what they're looking at advise whether the patch published here by Stefan Esser is in fact safe to install? While I'm very concerned that Apple haven't published an ...
3
votes
2answers
945 views

Where to check if a specific OS / service is vulnerable despite being patched, because of a vendor's decision?

I need to discuss how to mitigate the risk of services which are vulnerable despite being patched (typically because they are not maintained by the vendor anymore, or because the vendor does not want ...
3
votes
1answer
143 views

Is a newly installed server with no services running (but connected to the web) at risk?

A new server has just been installed but literally has nothing else running on it, no services setup to SSH in or anything yet (it's a Linux server). However, it is hooked up to the web so I can ...