Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [updates]

The tag has no usage guidance.

0
votes
0answers
7 views

Upgrading to latest Exchange CU vs Applying “Security Updates” for currently installed Exchange CU [migrated]

Hypothetical: a company has Exchange 20xx installed with CU8. They are skiddish about applying CUs, but will apply monthly updates for the Windows Server operating system, and "Security Updates for ...
1
vote
0answers
49 views

Is Dell SupportAssist insecure?

On an OEM Windows install on a Dell XPS 13, when I navigate to the Dell support website, it offers to download and install updates (even firmware updates!) on the spot, in the browser, flaunting all ...
0
votes
0answers
33 views

Does upgrading the JVM version resolve security issues, even if I'm using an older language version?

Hypothetically, let's presume Java version X (an old version) has a known security vulnerability. If I've been using this version of Java, and say hosting webservers with that version, it's "unsafe". (...
46
votes
8answers
9k views

Replacing Windows 7 security updates with anti-virus?

Microsoft has announced Windows 7 will no longer be receiving updates after January 14, 2020: Here. I hate windows 10's forced updates and telemetry so I have always stuck with Windows 7, but it may ...
3
votes
1answer
94 views

Avoiding the race condition between time of release and time of update

There is a kind of race condition between the time when a developer releases a security update and the time when the security update is actually applied by the user. In the meantime, an attacker will ...
2
votes
2answers
242 views

Would an Ubuntu server accessible from the internet be hacked within days?

I created an Ubuntu server on Digital Ocean to deploy my app on. Less then 24 hours later, I log in to the server and see this: 18 packages can be updated. 7 updates are security updates. I install ...
1
vote
1answer
40 views

Can my machine be compromised if I use an outdated application and the input data is trusted?

Suppose I decide to use an outdated application for some reason: maybe I can't update it for compatibility reasons, or updates are not provided in the official repositories I use, or maybe I just don'...
2
votes
1answer
448 views

Is there a multi-layered DoS protection which can be tightly integrated with cloud hosting services?

I know that one can deny services (DoS) in any of the 7 layers of the OSI model and that in principle, a denial can be done by a single entity (human or machine) or from 2 or more such entities ("...
0
votes
2answers
184 views

What consequences could there be to the continued use of an operating system without updating?

As it is well known, the extended support of Windows 7 (Service Pack 1) ends on January 14, 2020. Due to the short time that remains, I raise this question. What consequences could an outdated ...
91
votes
5answers
20k views

How do services with high uptime apply patches without rebooting?

How are critical security updates installed on systems which you cannot afford to reboot but the update requires a reboot. For example, services/businesses that are required to run 24x7 with zero ...
0
votes
0answers
45 views

Why would IPS vendor provider refuse to publish SLAs to fix the published highly ranked CVEs?

One of the biggest IPS providers (top of Gartner graph for its category) is not providing SLAs for all the 7+ ranking CVEs published last year. I don't really understand why would they refuse to ...
1
vote
2answers
114 views

Is it OK to not update devdependencies?

When checking third party libraries used in package.json and build.gradle files with tools such as Snyk, they allow the option to check for devdependencies. A lot of the time there is vulnerabilities ...
0
votes
2answers
102 views

Risk of infecting the host OS if the guest OS is out of date [duplicate]

I'd like to know how much the risk changes if I don't update the software on the guest OS in a VM (applications and the guest operating system itself), compared to the risk in case it's all kept up-to-...
-4
votes
1answer
85 views

About router vulnerabilities that could lead to MITM attacks [duplicate]

I recently read an answer on this stackexchange that informed me that, if a person knows my IP, it can try to hack into my router and change the DNS in order to perform a MITM attack. Now, this is ...
1
vote
1answer
345 views

Can I trust a ubuntu repo mirror in a less 'free' country?

For example, if I install Ubuntu in Dubai or in Saudi Arabia, I'll probably get a local mirror. Is there a way I can make sure that the ubuntu packages I get when I do apt-get update are the 'real' ...
5
votes
4answers
272 views

If I want a more secure and up-to-date Linux, in what cases should I avoid the official repositories?

The problem is this: Linux repositories (depending on the distribution) provide software and updates, but usually that software is not the latest official version, but it's an old version or branch ...
9
votes
1answer
924 views

Does Windows Update modify Hosts file?

I have Avira installed with Hosts file protection enabled. I've noticed a pattern where Avira warns me of an attempted modification of the Hosts file (but alas doesn't tell me which process did the ...
0
votes
0answers
23 views

Linux aarch64 security update provision, Raspberry Pi

Do any of the major Linux distributions (Fedora, Debian, Arch, Ubuntu, etc.) provide timely security updates for the aarch64 architecture for kernel and other standard system components present in a ...
2
votes
2answers
662 views

Is there a microcode or other hardware fix for Meltdown?

Linked to my question here, the MS support page states In addition to installing the January security update, a processor microcode update is required. But previous articles I've read said ...
-1
votes
1answer
156 views

Debian 9 opted out of data collection, doing it anyway?

I've noticed when I log in to my Debian 9 account, it informs me that there are updates. I update and upgrade in terminal and it informs me that 0 bytes have been downloaded but requests to upload ...
3
votes
1answer
92 views

Why are downloads of Mac updates redirected to plain HTTP? [duplicate]

I am downloading an inbetween version of MacOS necessary to update to High Sierra from an older version of El Capitan from here. Funny thing is, when I right click and get the download link from ...
5
votes
1answer
979 views

Has Ubuntu been patched for KRACKs?

I updated my Ubuntu 14.04 LTS. My /var/log/apt/history.log says that linux-signed-image-3.13.0-134-generic:amd64 has been installed. The changelog page says linux (3.13.0-134.183) trusty; ...
5
votes
0answers
77 views

Update intervals of VPN client code

I recently had to find a VPN client to connect to a preconfigured Cisco IPSec VPN. Of course there's Cisco's own client implementation AnyConnect, but I wanted to stick with a free alternative if ...
0
votes
3answers
225 views

Tor exit node as CentOS mirror

Today we saw traffic going from CentOS servers to a Tor exit node. This caused some raised eyebrows and led us to investigate what was going on. In the end it turned out that this exit node also acts ...
-2
votes
2answers
117 views

How safe are encrypted file systems and how does their updates work? [closed]

Not so long ago the media widely discussed the deciphering of the encrypted iPhone of a terrorist in the United States. Apple said it was impossible to decrypt. Edit: The iPhone was encrypted, and ...
0
votes
2answers
298 views

Suspicious established network connection

So, while I casually did a netstat -a for an unrelated matter I found this connection open that seemed (at least to my untrained eye) strange: Where Name was the last name of another current employee ...
0
votes
1answer
89 views

Is the RHEL 7 version of FreeRadius not affected by RHSA-2017:1759 (or similar)?

In July 2017, multiple security issues have been found in FreeRadius 2.x.x and 3.0.x. RHEL 6 uses FreeRadius 2.x.x and Red Hat has released security advisory RHSA-2017:1759. However, for RHEL 7, no ...
56
votes
3answers
9k views

My Android phone is vulnerable, but there are no updates?

I bought brand new HTC Desire 526G with operating system 4.4.2 (Kitkat), everything is as it should be (not rooted) so it is still on factory settings. But now I didn't get for a long time any ...
0
votes
1answer
76 views

How to enforce software updates on workstations?

There are many workstations on the company network with various kind of software installed: web browsers, OpenVPN clients, remote management agents, encryption utilities and other tools. Some of the ...
4
votes
1answer
285 views

How does a botnet update?

So recently I started to study how botnets work. But recently I stumbled onto a problem. I even tried brain storming how it would do it, but I couldn't think how a bot would update its code. I also ...
4
votes
1answer
363 views

Windows 7 and missing patches and how to handle

With the ransomware scare, someone asked me to look at their computer to make sure they have the required patch. They had no patches after June 2016, with only the recent May 2017 patches installed. ...
2
votes
0answers
2k views

MS Updates for MS17-010

Anybody know what the KB numbers are for Windows 10 1607 64 bit and 64 bit for 1511? I am assuming these are them, can someone please verify this for me? Also, for the Windows 1607 there is a ...
2
votes
4answers
249 views

Patch management for avoiding issues like EternalBlue [closed]

Following the 2017 WannaCry attack against big institutions like the NHS or Telefónica did not apply the Microsoft security patches associated with EternalBlue and were forced to deal with a ...
3
votes
1answer
846 views

Do MS monthly security rollups include previous monthly rollups?

do Microsoft monthly quality security rollups include previous-monthly releases? For example, if you skip march rollup and install april's?
0
votes
1answer
69 views

Changing server side certificate during ongoing connection -> is it supported ? what are the effects on the existing connections?

I was wondering (based on the TLS RFC and its current implementation by the major vendors / platforms - i.e. Microsoft's IIS): how would an existing active SSL / TLS session behave / react if the ...
2
votes
1answer
407 views

How likely is it that the Hot Potato vulnerability can be exploited on a up-to-date Windows 2012 machine?

I recently found an article about the Hot Potato vulnerability and it seemed quite interesting. Using this technique, we can elevate our privilege on a Windows workstation from the lowest levels to ...
4
votes
1answer
859 views

Anniversary Update with Bitlocker Reboot without Encryption Key

I have Windows 10 Professional installed and have avoided the Anniversary Update until yesterday. The computer installed the update despite my best efforts to stop it. But that is a different ...
2
votes
4answers
2k views

Unauthenticated packages in debian

Yesterday I updated my debian server using: apt-get update && apt-get upgrade I received message that some of the packages cannot be authenticated being in a rush I hit yes to install ...
6
votes
3answers
181 views

When to change a smartphones with out-of-support OS's?

As we know it from e.g Windows OS on desktops, if the support is outdated there is a risk for security and feature bugs and unstable OS. If a smartphone can't be updated to use a newer OS because of ...
0
votes
2answers
89 views

Is there any reason to enable “Windows Update” if you do not connect your computer to the network/internet?

I am looking to have a computer that I want to keep development only, and try not to connect to the internet, or my network at all. I am curious if there is anything wrong with not updating anything ...
0
votes
1answer
388 views

Safety of packages through yum

Recently, a yum update installed an update to R1Soft's server backup management software on a Redhat 7 server I am dealing with, and rkhunter is giving me a warning about a suspicious file. I've asked ...
0
votes
1answer
53 views

Reinstalled Windows 8. Is the computer vulnerable during the wait for updates?

After re-installing Windows 8.1, during the wait for updates of an hour or more, is the computer vulnerable to being hacked (if it's running the Windows Firewall and an Anti-Virus program)?
1
vote
1answer
65 views

From when does the operating systems sign the updates?

Which was the year the linux distributions, windows have first used to sign their updates? Historical question that is hard to "google".
1
vote
0answers
404 views

Encrypting OTA software updates files for embedded devices

I need to encrypt and send update files of the order of 100K from a server, through a mobile app, to low power wireless embedded devices (32 bit). The file transfers will be infrequent. The mobile ...
0
votes
0answers
27 views

From where can I get latest security bug fixes list/details implemented by web browsers?

Every now and then a new vulnerability is discovered in web browsers, some get fixed with time, some don't (maybe because of dependencies), from where can I get the report of latest bugs fixed or ...
1
vote
1answer
77 views

How is a software update done securely?

So a secure boot process starts with a hardware based chain of trust. The root public key is baked into the ROM which is used to verify the low level boot loader which in turn boots the kernel. With ...
0
votes
3answers
124 views

If a system is updated, does that mean metasploit framework cannot penetrate the system?

I have been learning about metasploit and it is a framework of exploit and payloads. So what if the system is updated, does that mean those exploits won't work anymore? Can you explain more about it?
2
votes
1answer
3k views

What are best practices for keeping up to date Linux servers?

I recently moved from Windows Server administration to Linux administration. In Windows I get used to practice that all critical and security updates are installed ASAP on their release. On Windows ...
2
votes
3answers
179 views

Did information technology had a increase or decrease in security with the introduction of automatic update features?

For obvious reasons we teach users Always update... updates are good... never forget updates, et cetera! Apart from the danger of malicious advertisements that make use of that showing users ...
3
votes
2answers
224 views

Does a virtualised Windows machine without internet access need (security) updates?

I recently saw a Windows 7 machine (virtually running in a Xen environment) and used in a production network to perform certain automated tasks. This system was missing over a 100+ Windows update ...