3 ms·
I know at least sometimes they just do a simple check of the version of a service and report off that. We've issued vendor-supplied hotfixes that don't update t
by bluedino 4y ago
I know at least sometimes they just do a simple check of the version of a service and report off that. We've issued vendor-supplied hotfixes that don't update the version number, and even though the software is patched, scanning tools will still report that it's vulnerable.
- nibbleshifter 4y agoBack ported fixes in certain distros are a nightmare when doing vuln management. "Scanner says its a vulnerable version based on the version number" "Well, its up to date... Fix is back ported..." Imagine having this argument, over dozens of tickets, every $time_interval. Its no wonder actual critical issues go unfixed.
- a2tech 4y agoYes. RedHat/CentOS/other LTS OSes are a nightmare for vulnerability scanning. I should say it's a bonanza for the security contractors and a nightmare for those of us that actually deal with it. So many pencil pushers throwing fits when you reply to the hundreds of vulnerability tickets with 'vendor back ported fix'. Also see PCI compliance.