Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have had my boss do vulnerability scans on our servers using online services and it's frustrating trying to explain that we don't actually suffer from the vulnerabilities that the reports say we do.

Am I kidding myself or am I right in saying that these services "assume" because you allow posting to your site that it's vulnerable? I've tested a bunch of injection attacks and our server returns never allows them to execute because the code stops it.

What is the best way to make my server immune to these scans? I get a few things, like stopping apache/php/openSSL from reporting it's versions, especially because I use security patched versions from the Debian security team which doesn't necessarily match the patched version for PHP.

share|improve this question
    
What scan(s) are you using specifically? –  squillman Sep 1 '10 at 13:23

1 Answer 1

The problem with these reports is that they just assume that if you allow user data entry on your site, then you are vulnerable to SQL injection attacks. There is no way for them to tell without actually looking at your SQL, or performing an injection attack, so they just flag it as a potential problem.

The only real way to prove to your boss that your are safe, is either to get a security expert come in and check your site, or get your boss to understand what an injection attack is, and show him it not working on your site.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.