[CentOS] security compliance vs. old software versions

Tue Jun 29 21:37:32 UTC 2010
Bill Campbell <centos at celestial.com>

On Tue, Jun 29, 2010, Brian Mathis wrote:
>On Tue, Jun 29, 2010 at 5:11 PM, Les Mikesell <lesmikesell at gmail.com> wrote:
>> What's the correct response to a security scan that points out that
>> apache versions below 2.2.14 have multiple known vulnerabilities?  Is
>> there an official document about what known vulnerabilities have been
>> fixed in the RHEL/CentOS updates or do you have to wade through the
>> changelog to try to find each thing?
>>
>> --
>>   Les Mikesell
>>    lesmikesell at gmail.com
>
>Have them read this:
>http://www.redhat.com/security/updates/backporting/?sc_cid=3093
>
>If you're dealing with an auditor, that should be all they need as at
>least they can write down that you've made a conscious decision based
>on that information.

That's assuming the auditor can read, which seems doubtful
considering what I've found with Securityfocus and similar PCI
testing outfits.

Bill
-- 
INTERNET:   bill at celestial.com  Bill Campbell; Celestial Software LLC
URL: http://www.celestial.com/  PO Box 820; 6641 E. Mercer Way
Voice:          (206) 236-1676  Mercer Island, WA 98040-0820
Fax:            (206) 232-9186  Skype: jwccsllc (206) 855-5792

Financial panics, if left alone, rarely cause much damage to the real
economy, output, employment or production. Asset values fall sharply and
wipe out those who borrowed and lent too much, thereby redistributing
wealth from the foolish to the prudent.  -- Arthur Laffer