1

I'm performing an audit on one of our boxes using OpenVAS which reported that the device was missing a large number of Solaris patches. I am trying to determine whether these are false positives or not so I have a question which I would appreciate some guidance.

Say for instance that OpenVAS reports that I am missing patch 141001-03 and when I do patchadd -p | grep 141001-03 I get no standard output showing that it is indeed correct that I do not have patch 141001-03. However, if I grep for 141001 and I get a match that says 151001-60 Obsoletes: 141001-04 but I do not have 141001-04 installed on the system - does this mean that I still require 141001-03 or is 151001-03 sufficient in remediating the vulnerability - as Solaris patches are 'Cumulative'.

Just another related question whilst we are on the subject, if there is "No current revision" installed, does this mean that it is not necessarily necessary.

3

In this case 141001-03 was superceded by 141001-04. Which in turn was superceded by 151001-60, which you have installed. So your system has the issues associated with 141001-03, 141001-04 and 151001-60 patched. Cumulative patching.

More information on Oracle's page at Overview of Solaris Patch Types and Dependencies

Unsure about what you mean by ""No current revision" installed, does this mean that it is not necessarily necessary", can you elaborate?

  • Thanks, very well explained. @BitsOfNix explained the "No Current Revision" part really well too – George Pascal Oct 23 '16 at 20:37
2

In simple terms, if a patch states that obsoletes another one, then you do not need to apply the one that shows as missing. So in your case 141001-XX does not need to be applied. In fact, if you try to apply it will state that there is already a patch that supersedes it.

No current revision installed can be taken both way. If the scanner accuses it, then perhaps you need it. But before applying take a look what it is. As an example, certain scanners base the check on the Oracle Recommended patch bundle. This bundle includes for example patches for Firefox. If you removed it it will should as revision missing and you don't have to install the patch because you do not have the software installed. On the other hand, you might have to install if it is a software that you have installed and it has not been patched.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.