4

We are currently working our way through a PCI compliance assessment on our server running CentOS.

We are getting a lot of 'severe' issues with suggested fixes. The suggestions to rectify the issues are mostly to update the packages to the latest version. Sound advice I thought, until I ran 'sudo yum update', then ran that scan again and frustratingly the issues hadn't gone.

I spoke to our hosting provider (it's a dedicated server) and they said that although the version is up to date it will have various patches that fix known security issues.

They suggested running a changelog command for the packages and then appealing each of the severe issues flagged on the scan. So I went to create an appeal for the first issue and it asked for the version of the package, the patch level and the reason I feel we're exempt.

So, in CentOS what's the simplest way of showing the version number and patch level for each individual installed package?

3 Answers 3

5

rpm -q <package name> will give you the software version number as well as the package release number, but you will need to investigate the contents of rpm --changelog <package name> in order to determine which patches have been applied.

2
  • Would it be possible to print the results of this to a text file but include ALL packages?
    – dannymcc
    Aug 1, 2011 at 19:29
  • 1
    You can redirect the result of rpm -qa --qf '***\n%{name}-%{version}-%{release}\n' --changelog to a file, but note that some changelogs are very long. Aug 1, 2011 at 19:32
2

To list all packages:

rpm -qa

To list all packages matching a simple pattern:

rpm -qa 'kernel*'
2

Your PCI auditor is an idiot (quel surprise). They just run an automated tool like nessus, which does nothing but compare the service's reported version against a list of vulnerabilities against the upstream version -- they don't say "hey, this is patchlevel N of this package, RedHat already patched that for all known vulnerabilities".

Ultimately, you'll have to get the list of CVEs that the report says you're vulnerable to (if the auditor can't even give you that... well, they are idiots, so you're already screwed) and then dig through the CentOS changelogs to see that they've been fixed (there might also be a security reports system you can look through). RHN has some sort of CVE lookup service, but since you're not paying for RHEL, you presumably won't have access to it.

4
  • The report does show CVE references for each vulnerability...
    – dannymcc
    Aug 2, 2011 at 6:49
  • Good for you. One step down.
    – womble
    Aug 2, 2011 at 9:18
  • The appeal process is a nightmare, one issue at a time pasting the same version info into each. Are there any companies that actually check the patch level rather than the upstream version?
    – dannymcc
    Aug 2, 2011 at 9:35
  • Probably. I've certainly never had an auditor that required me to "appeal" every issue individually like you describe, but... well, your auditor is an idiot.
    – womble
    Aug 2, 2011 at 9:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .