I'm performing an audit on one of our boxes using OpenVAS which reported that the device was missing a large number of Solaris patches. I am trying to determine whether these are false positives or not so I have a question which I would appreciate some guidance.
Say for instance that OpenVAS reports that I am missing patch
141001-03 and when I do
patchadd -p | grep 141001-03 I get no standard output showing that it is indeed correct that I do not have patch
141001-03. However, if I grep for
141001 and I get a match that says
151001-60 Obsoletes: 141001-04 but I do not have 141001-04 installed on the system - does this mean that I still require
141001-03 or is
151001-03 sufficient in remediating the vulnerability - as Solaris patches are 'Cumulative'.
Just another related question whilst we are on the subject, if there is "No current revision" installed, does this mean that it is not necessarily necessary.