[置顶] RH413企业安全加固 第2章 跟踪安全更新
第2章 跟踪安全更新
RHBA是 bug advisory (关于BUG的更新)
RHSA是 security advisory (关于安全的更新)
RHEA是 enhancement advisory (关于性能增强的更新)
1、执行yum updateinfo 需要一个插件包
rpm -qa|grep yum-plugin-security (查看插件包是否安装)
默认情况是没有安装的
2、使用yum命令生成更新报告，并且对bug修复公告和增强性公告进行计数
[root@student yum.repos.d]# yum updateinfo
Loaded plugins: product-id, refresh-packagekit, security, subscription-manager
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
Updates Information Summary: available
36 Security notice(s)
9 Critical Security notice(s)
11 Important Security notice(s)
16 Moderate Security notice(s)
22 Bugfix notice(s)
3 Enhancement notice(s)
updateinfo summary done
3、使用yum命令生成rpm包的更新报告
[root@student yum.repos.d]# yum updateinfo list
Loaded plugins: product-id, refresh-packagekit, security, subscription-manager
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
RHBA-2013:0659 bugfix autofs-1:5.0.5-74.el6_4.x86_64
RHSA-2013:0550 Moderate/Sec. bind-libs-32:9.8.2-0.17.rc1.el6.3.x86_64
RHSA-2013:0689 Important/Sec. bind-libs-32:9.8.2-0.17.rc1.el6_4.4.x86_64
RHSA-2013:0550 Moderate/Sec. bind-utils-32:9.8.2-0.17.rc1.el6.3.x86_64
RHSA-2013:0689 Important/Sec. bind-utils-32:9.8.2-0.17.rc1.el6_4.4.x86_64
RHSA-2013:0668 Moderate/Sec. boost-filesystem-1.41.0-15.el6_4.x86_64
RHBA-2013:0692 bugfix boost-filesystem-1.41.0-17.el6_4.x86_64
RHSA-2013:0668 Moderate/Sec. boost-system-1.41.0-15.el6_4.x86_64
RHBA-2013:0692 bugfix boost-system-1.41.0-17.el6_4.x86_64
RHBA-2013:0703 bugfix coreutils-8.4-19.el6_4.1.x86_64
RHBA-2013:0703 bugfix coreutils-libs-8.4-19.el6_4.1.x86_64
RHSA-2013:0580 Moderate/Sec. cups-1:1.4.2-50.el6_4.4.x86_64
RHSA-2013:0580 Moderate/Sec. cups-libs-1:1.4.2-50.el6_4.4.x86_64
RHSA-2013:0771 Moderate/Sec. curl-7.19.7-36.el6_4.x86_64
RHSA-2013:0568 Important/Sec. dbus-glib-0.86-6.el6_4.x86_64
RHBA-2011:1395 bugfix dmidecode-1:2.11-2.el6_1.x86_64
RHSA-2013:0271 Critical/Sec. firefox-17.0.3-1.el6_3.x86_64
RHSA-2013:0696 Critical/Sec. firefox-17.0.5-1.el6_4.x86_64
4、使用yum命令查看指定安全公告
[root@student yum.repos.d]# yum updateinfo RHSA-2013:0815
Loaded plugins: product-id, refresh-packagekit, security, subscription-manager
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
===============================================================================
Moderate: httpd security update
===============================================================================
Update ID : RHSA-2013:0815
Release :
Type : security
Status : final
Issued : 2013-05-13 00:00:00
Bugs : 915883 - CVE-2012-3499 httpd: multiple XSS flaws due to unescaped hostnames
: 915884 - CVE-2012-4558 httpd: XSS flaw in mod_proxy_balancer manager interface
: 953729 - CVE-2013-1862 httpd: mod_rewrite allows terminal escape sequences to be written to the log file
CVEs : CVE-2012-4558
: CVE-2013-1862
: CVE-2012-3499
Description : The Apache HTTP Server is a popular web server.
:
: Cross-site scripting (XSS) flaws were found in the
: mod_proxy_balancer module's manager web interface.
: If a remote attacker could trick a user, who was
: logged into the manager web interface, into
: visiting a specially-crafted URL, it would lead to
: arbitrary web script execution in the context of
: the user's manager interface session.
: (CVE-2012-4558)
:
: It was found that mod_rewrite did not filter
: terminal escape sequences from its log file. If
: mod_rewrite was configured with the RewriteLog
: directive, a remote attacker could use
: specially-crafted HTTP requests to inject terminal
: escape sequences into the mod_rewrite log file. If
: a victim viewed the log file with a terminal
: emulator, it could result in arbitrary command
: execution with the privileges of that user.
: (CVE-2013-1862)
:
: Cross-site scripting (XSS) flaws were found in the
: mod_info, mod_status, mod_imagemap, mod_ldap, and
: mod_proxy_ftp modules. An attacker could possibly
: use these flaws to perform XSS attacks if they
: were able to make the victim's browser generate an
: HTTP request with a specially-crafted Host header.
: (CVE-2012-3499)
:
: All httpd users should upgrade to these updated
: packages, which contain backported patches to
: correct these issues. After installing the updated
: packages, the httpd daemon will be restarted
: automatically.
Severity : Moderate
updateinfo info done
5、使用yum命令生成指定CVE在本机的全部更新
[root@student yum.repos.d]# yum updateinfo list --cve=CVE-2012-4558
Loaded plugins: product-id, refresh-packagekit, security, subscription-manager
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
RHSA-2013:0815 Moderate/Sec. httpd-2.2.15-28.el6_4.x86_64
RHSA-2013:0815 Moderate/Sec. httpd-tools-2.2.15-28.el6_4.x86_64
updateinfo list done
6、使用yum 命令对本机可用的安全更新公告中包括多少安全软件包
[root@student yum.repos.d]# yum --security list updates
Loaded plugins: product-id, refresh-packagekit, security, subscription-manager
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
Limiting package lists to security relevant ones
86 package(s) needed for security, out of 110 available
Updated Packages
bind-libs.x86_64 32:9.8.2-0.17.rc1.el6_4.4 bb
bind-utils.x86_64 32:9.8.2-0.17.rc1.el6_4.4 bb
boost-filesystem.x86_64 1.41.0-17.el6_4 bb
boost-system.x86_64 1.41.0-17.el6_4 bb
cups.x86_64 1:1.4.2-50.el6_4.4 bb
cups-libs.x86_64 1:1.4.2-50.el6_4.4 bb
curl.x86_64 7.19.7-36.el6_4 bb
dbus-glib.x86_64 0.86-6.el6_4 bb
firefox.x86_64 17.0.6-1.el6_4 bb
freetype.x86_64 2.3.11-14.el6_3.1 bb
gnutls.x86_64 2.8.5-10.el6_4.1 bb
httpd.x86_64 2.2.15-28.el6_4 bb
httpd-tools.x86_64 2.2.15-28.el6_4 bb
kernel.x86_64 2.6.32-358.6.2.el6 bb
kernel-firmware.noarch 2.6.32-358.6.2.el6 bb
krb5-libs.x86_64 1.10.3-10.el6_4.2 bb
krb5-workstation.x86_64 1.10.3-10.el6_4.2 bb
libcurl.x86_64 7.19.7-36.el6_4 bb
libipa_hbac.x86_64 1.9.2-82.7.el6_4 bb
libipa_hbac-python.x86_64 1.9.2-82.7.el6_4 bb
libproxy.x86_64 0.3.0-4.el6_3 bb
libproxy-bin.x86_64 0.3.0-4.el6_3 bb
libproxy-python.x86_64 0.3.0-4.el6_3 bb
libsss_autofs.x86_64 1.9.2-82.7.el6_4 bb
libsss_idmap.x86_64 1.9.2-82.7.el6_4 bb
libxml2.x86_64 2.7.6-12.el6_4.1 bb
libxml2-python.x86_64 2.7.6-12.el6_4.1 bb
mysql-libs.x86_64 5.1.69-1.el6_4 bb
7、使用yum命令 和管道符命令查出本机最严重的级别的包有多少
[root@student yum.repos.d]# yum updateinfo list |grep 'Critical'|cut -f1 -d ' '|sort -u|wc -l
9
8、使用yum命令查看安装那个包可以解决安全问题
[root@student yum.repos.d]# yum updateinfo list httpd-tools
Loaded plugins: product-id, refresh-packagekit, security, subscription-manager
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
RHSA-2013:0815 Moderate/Sec. httpd-tools-2.2.15-28.el6_4.x86_64
updateinfo list done
9、使用yum命令列出RHSA-2013:0815所需要的包
[root@student yum.repos.d]# yum updateinfo list --advisory=RHSA-2013:0815
Loaded plugins: product-id, refresh-packagekit, security, subscription-manager
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
RHSA-2013:0815 Moderate/Sec. httpd-2.2.15-28.el6_4.x86_64
RHSA-2013:0815 Moderate/Sec. httpd-tools-2.2.15-28.el6_4.x86_64
updateinfo list done