Penetration Testing mailing list archives
RE: Patch management tool
From: Steffen Kluge <kluge () fujitsu com au>
Date: Thu, 09 Sep 2004 17:17:13 +1000
On Wed, 2004-09-08 at 02:31, Todd Towles wrote:
I use Yum on my FC2 box. I modified my yum.conf to use all the mirrors and everything. After doing a Nessus scan on my own box, I saw that my SSH verion was pre-3.7.1 Not good, yum didn't see it and I had to update my OpenSSH myself.
The current openssh package for FC2 is openssh-3.6.1p2-34, which is the one FC2 was released with. There are no updates, so yum isn't missing anything. Keep in mind that RedHat usually backports security fixes into their maintained package versions, rather than dropping in new versions that often entail changed functionality as well. Most large distro's do it that way, for obvious reasons of stability and compatibility. Simple-minded vuln scanners that raise alerts based on reported software versions alone, rather than testing for the presence of specific vulnerabilities are just dumb (yet annoyingly common). The openssh package that comes with FC2 has no publicly known vulnerabilities, and contains fixes for all published security bugs, including those discovered in fall 2003. You can verify that by reading the changelog (rpm -q --changelog openssh) or by reading RH's errata. Only install latest versions from the original maintainers if you need the added functionality and have tested their compatibility with your environment. Unless you like a gamble... Cheers Steffen.
Attachment:
signature.asc
Description: This is a digitally signed message part
Current thread:
- Patch management tool Milind Nanal (Sep 03)
- Re: Patch management tool Edward W Howe (Sep 04)
- Re: Patch management tool Chris Griffin (Sep 04)
- Re: Patch management tool Alvin Oga (Sep 07)
- Re: Patch management tool Miles Stevenson (Sep 04)
- Re: Patch management tool - pen-test Alvin Oga (Sep 07)
- RE: Patch management tool roman one (Sep 07)
- Re: Patch management tool Jose Maria Lopez (Sep 07)
- <Possible follow-ups>
- RE: Patch management tool Todd Towles (Sep 07)
- RE: Patch management tool Steffen Kluge (Sep 09)
- Re: Patch management tool Jérôme (Sep 07)
- Re: Patch management tool Jose Maria Lopez (Sep 08)
- RE: Patch management tool Harper, Patrick (Sep 09)
- RE: Patch management tool R. DuFresne (Sep 10)
- RE: Patch management tool Todd Towles (Sep 09)
- Re: Patch management tool Kurt Seifried (Sep 10)
- Re: Patch management tool James Riden (Sep 12)
- RE: Patch management tool Todd Towles (Sep 09)
- RE: Patch management tool Les Bell (Sep 11)