Solved

Apache tomcat vulnerabilities

Posted on 2012-03-12
5
350 Views
Last Modified: 2012-04-02
1) As a rough figure how often do Apach release security patches for Tomcat? I.e. per month, per week, how many?

2) And what tools can admins use to ensure that their apache is kept up to date? Do apache provide any free ones?

3) What would auditors look for when reviewing pacth management procedures for non MS software? For example if you did a scan and it said "apache out of date", they may apply a patch and then rescan and its gone, only for next week 5 more patches to come out and then its insecure again, and the process isnt managed.

4) So what demonstrates good patch management, i.e. what visually shows the auditor that this problem wont happen again?
0
Comment
Question by:pma111
  • 3
  • 2
5 Comments
 
LVL 3

Author Comment

by:pma111
ID: 37709493
And should a vulnerability assessment/pen test identify "how things came to be so insecure", or is the va/pen test really just to show "this is how insecure how things are, here are the quick fixes, the strategy behind how these are prevented long term is your audit depts problem not us"?
0
 
LVL 26

Accepted Solution

by:
Leon Fester earned 500 total points
ID: 37709789
Check the quick downloads section:
http://benchmarks.cisecurity.org/en-us/?route=default
0
 
LVL 3

Author Comment

by:pma111
ID: 37710190
Thanks for the benchmark, but I'd still appreciate replies in line with 1-5 posted above for future reference.
0
 
LVL 26

Expert Comment

by:Leon Fester
ID: 37719869
Did you even bother to look at the link and download one of the files from this site?

If you did then you'd see a whole lot more than just a 1-5 point.

Here is a snippet of one of the items in the Benchmarks

1.3.3 Lock the Apache User Account (Level 1, Scorable)
:Description
The user account under which Apache runs, should not have a valid password, but should be locked.

Rationale:
As a defense-in-depth measure the Apache user account should be locked to prevent logins, and to prevent a user from su-ing to apache using the password. In general, there shouldn’t
21 | P a g e
be a need for anyone to su as apache. If a need does exist, sudo should be used instead, which would not require the apache account password.

Remediation:
Use the passwd command to lock the apache account: # passwd -l apache

Audit:
Ensure the apache account is locked using the following:
# passwd -s apache
The results will be similar to the following:
apache LK 2010-01-28 0 99999 7 -1 (Password locked.)

Default Value:
The default user is daemon and is locked.

So you've got information to do the following
Describe your problems/issues
Rationale behind the recommendation
Remediation Actions to fix the problem
How to audit
Default values

If you apply the benchmark remediation correctly then you probably won't have many failed audit issues.
0
 
LVL 3

Author Comment

by:pma111
ID: 37723974
I did indeed and many thanks, but it would be useful to see how many on average security updates for apache are released per month, and I could find this information.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Big data transfers via information superhighways require special attention and protection. Learn more about the IT-regulations of the country where your server is located. Analyze cloud providers and their encryption systems for safe data transit. S…
I've been an avid user and supporter of Malwarebytes Premium Version 2.x for years. It's an excellent product that runs alongside just about any Anti-Virus application without issues. It seems to have an uncanny ability to pick up many things that A…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, just open a new email message. In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
A simple description of email encryption using a secure portal service. This is one of the choices offered by The Email Laundry for email encryption. The other choices are pdf encryption which creates an encrypted pdf of your email and any attachmen…

912 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now