Penetration Testing mailing list archives
RE: Patch management tool
From: "Les Bell" <lesbell () lesbell com au>
Date: Fri, 10 Sep 2004 11:07:25 +1000
"Todd Towles" <toddtowles () brookshires com> wrote:
Patrick is right, Red Hat will patch services but doesn't change the default version number in their banners. That way, you don't really know what level a service is, if you are trying to attack it. << Correct. Red Hat 7.3 is always Red Hat 7.3, and will always contain Apache 1.3.x, for example. This meets the needs of people who have written applications to that version of Apache (and PHP, etc.) and who don't want to risk breaking everything by moving to the latest and greatest Apache 2.0. However, Red Hat did - during the lifetime of RH 7.3 - back-port security fixes from later releases of the software - presumably Apache 2.0, for example.
I did a "rpm -q OpenSSH" and it came back with a older version. Maybe it was patched and I couldn't tell..it is possible. But I know for sure I running the newest now. =) << The only way you could tell what patches had been applied is by relating the RPM patch level to the Red Hat security advisories. The Red Hat openssh-3.5p1-9, for example, contained a fix for a buffer handling vulnerability (http://www.cert.org/advisories/CA-2003-24.html) that was fixed by the OpenSSH team in version 3.7.1 of their code. This strikes me as a lot of double handling, although it meets the needs of those who want a feature freeze for stability, but need security fixes. But talk about confusing . . . Best, --- Les Bell, RHCE, CISSP [http://www.lesbell.com.au] ------------------------------------------------------------------------------ Ethical Hacking at the InfoSec Institute. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. Check out our Advanced Hacking course, learn to write exploits and attack security infrastructure. Attend a course taught by an expert instructor with years of in-the-field pen testing experience in our state of the art hacking lab. Master the skills of an Ethical Hacker to better assess the security of your organization. http://www.infosecinstitute.com/courses/ethical_hacking_training.html -------------------------------------------------------------------------------
Current thread:
- RE: Patch management tool, (continued)
- RE: Patch management tool Todd Towles (Sep 07)
- RE: Patch management tool Steffen Kluge (Sep 09)
- Re: Patch management tool Jérôme (Sep 07)
- Re: Patch management tool Jose Maria Lopez (Sep 08)
- RE: Patch management tool Harper, Patrick (Sep 09)
- RE: Patch management tool R. DuFresne (Sep 10)
- RE: Patch management tool Todd Towles (Sep 09)
- Re: Patch management tool Kurt Seifried (Sep 10)
- Re: Patch management tool James Riden (Sep 12)
- RE: Patch management tool Todd Towles (Sep 09)
- RE: Patch management tool Les Bell (Sep 11)
- RE: Patch management tool Todd Towles (Sep 07)