Re: Rate of Critical/Security Patches

From: Douglas Siebert (dsiebert_at_excisethis.khamsin.net)
Date: 12/28/04

  • Next message: Bryan Brock: "Re: Rate of Critical/Security Patches" 
    Date: Tue, 28 Dec 2004 02:37:47 +0000 (UTC)

    "Bryan Brock" <bbrock@gmail.com> writes:

    >> Can anyone here point me to a site for reliable unbiased
    >> patching rate for SuSE Enterprise Linux, HP-UX, AIX and
    >> Windows Server?

    >Sounds like you're concerned with patches/time or critical patches/time
    >that would need to be done by someone on site.

    >I don't know of any site that has information on that, but if patching
    >rate = the number of patches released by a vendor over time, then it
    >should be possible to calculate it based on the dates of the last few
    >patch bundles for a target OS and the number of patches in each patch
    >bundle.

    >If you are looking for number of critical patches/month, you could do
    >something like this:

    >1. Download all the latest patch bundles for an OS.

    >2. Use a patch utility to count the patches and extract their dates.
    >If that's not possible, you could go to the vendor's patch site, count
    >the patches there, and try to find an associated date for each patch or
    >bundle on the site.

    >SLES patch dates:
    >rpm -q -a -P --info | grep "Build Date:"

    >HP-UX patch dates:
    >swlist -d -a readme -l patch @
    >/usr/local/adm/GOLDQPK11i_B.11.11.0406.5.depot | grep 'Creation'

    The date of "Creation" or "Build" often has nothing to do with when the
    patch comes out. And you are looking at a quality pack, which is released
    on a schedule, so you know how many of those there are for HP-UX. It is
    somewhere in between Microsoft's monthly patch bundles that collect a
    dozen or more patches, and a service pack that collects hundreds (except
    HP releases all the component patches separately so you don't have to wait
    if you need one right away) When you look at Linux you have to realize
    that SuSE and Redhat include about 5GB of stuff, so the patch totals for
    Linux are misleading because patches for some obscure version of a CD
    burning app that is only exploitable by a local user isn't really
    something you care about on a server -- but Microsoft will still count
    against Linux when they want to claim how it has more security problems
    than Windows)

    I don't think the OP is even asking the right question. What he really
    wants are servers that can be administrated remotely in large numbers
    without undue effort. Most people would agree that eliminates Windows,
    but between Linux, HP-UX and AIX they'd be on roughly equal footing. Once
    you have your scripts set up, it isn't really any harder to patch 2000
    servers than it is to patch 20. 

    -- 
Douglas Siebert                          dsiebert@excisethis.khamsin.net
"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety" -- Thomas Jefferson
  • Next message: Bryan Brock: "Re: Rate of Critical/Security Patches"

    Relevant Pages

    • Re: Learning process
      ... a million users on Windows would be ... Most of the patches are fixes for problems in security and a lot of ... pile of games or the SQL blaster which required 2 patchs - patch 1, ... holes *aren't* patched almost immediately. ...
      (alt.comp.lang.learn.c-cpp)
    • So Windows Update is a dog, now what?
      ... extension, that means that the soon-to-be-released Windows Update, ... How about someone getting serious about patch management over at ... In their explanation of the severity rating scheme, the Microsoft ... incredibly reliable mechanism for getting patches onto systems, ...
      (NT-Bugtraq)
    • Re: Windows patch mgmt.
      ... Subject: Windows patch mgmt. ... St. Benard's Update Expert to push out the patches and to verify they've ... to facilitate one-on-one interaction with one of our expert instructors. ...
      (Security-Basics)
    • Re: Is MSIE dead as a browser - if Microsoft does not patch it then it is as far as I am concerned!
      ... M$ issuing patches "PDQ" is ... >> files served by the web server. ... this vulnerability ... the installed patch ...
      (microsoft.public.security.virus)
    • RE: [Full-Disclosure] Whos to blame for malicious code?
      ... >> windows admins were and remain just plain lazy, ... > deploying patches to an enterprise in a timely manner. ... the problem is solved and the malicious code has no impact. ... this patch undoes what last weeks patches did. ...
      (Full-Disclosure)