From: Les Bell (lesbell@lesbell.com.au)
Date: Thu Sep 09 2004 - 21:07:25 EDT
"Todd Towles" <toddtowles@brookshires.com> wrote:
>>
Patrick is right, Red Hat will patch services but doesn't change the
default version number in their banners. That way, you don't really know
what level a service is, if you are trying to attack it.
<<
Correct. Red Hat 7.3 is always Red Hat 7.3, and will always contain Apache
1.3.x, for example. This meets the needs of people who have written
applications to that version of Apache (and PHP, etc.) and who don't want
to risk breaking everything by moving to the latest and greatest Apache
2.0. However, Red Hat did - during the lifetime of RH 7.3 - back-port
security fixes from later releases of the software - presumably Apache 2.0,
for example.
>>
I did a "rpm -q OpenSSH" and it came back with a older version. Maybe it
was patched and I couldn't tell..it is possible. But I know for sure I
running the newest now. =)
<<
The only way you could tell what patches had been applied is by relating
the RPM patch level to the Red Hat security advisories. The Red Hat
openssh-3.5p1-9, for example, contained a fix for a buffer handling
vulnerability (http://www.cert.org/advisories/CA-2003-24.html) that was
fixed by the OpenSSH team in version 3.7.1 of their code. This strikes me
as a lot of double handling, although it meets the needs of those who want
a feature freeze for stability, but need security fixes. But talk about
confusing . . .
Best,
--- Les Bell, RHCE, CISSP
[http://www.lesbell.com.au]
------------------------------------------------------------------------------
Ethical Hacking at the InfoSec Institute. All of our class sizes are
guaranteed to be 12 students or less to facilitate one-on-one interaction
with one of our expert instructors. Check out our Advanced Hacking course,
learn to write exploits and attack security infrastructure. Attend a course
taught by an expert instructor with years of in-the-field pen testing
experience in our state of the art hacking lab. Master the skills of an
Ethical Hacker to better assess the security of your organization.
http://www.infosecinstitute.com/courses/ethical_hacking_training.html
-------------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:54:05 EDT