Convenient source for information on known exploits (not theoretical)

Question

Forgive me if this question has been asked before or is off-topic.

The past couple of security patches I've installed have been discovered from reading news articles, which publicly discuss security vulnerabilities that apply to software on my servers. Here are two examples of such exploits that I have read from an article.

• Apache Fixes Range Header Flaw, Again

• New JBOSS Worm Infecting Unpatched Servers

Needless to say I am not pleased that I had to discover these exploits existed on Slashdot, of all places. I have patched these, but I would like to have some easy way to be notified, or location that I can easily search for known exploits in the wild that pertain to me.

I am already running on major negative time as it is, so regularly updating security patches as they are released is completely and unquestionably impossible. I need to ignore "theoretical vulnerabilities" until they become practical.

Do any of you have good information on where to find such a source of information?

If so, do any such services have the ability to alert you when a patch becomes available for a known exploit in software you are interested in?

EDIT:

Not sure what the downvotes are about, was I not clear? Is my question OT? I just want to put it out there that I am not implying in any way that patching against theoretical vulnerabilities is a bad idea or a waste of time.

I'm merely stating the depressing reality of my situation, working for a tiny company in a horrible economy where I'm expected to do the work of 6 people. The reality of not making payroll as it is for next month is more likely to be the downfall of my company than theoretical security vulnerabilities that I don't have time to address.

Answer 1

I'd caution against ignoring vulnerabilities simply because they have no publicly available exploit code - while those that get published to slashdot are highly visible, there's important software fixes getting released all the time, with and without public exploit code available. Mostly without.

However, keep in mind that once a patch is released for a vulnerability, even one that's privately reported, the cat's out of the bag - attacks can often be reverse-engineered based on the changes in the patch.

---

All of that being said, I can certainly appreciate that it's fatiguing trying to keep up with patches for all of the software that you're interested in. There's a ton of resources out there.

One option is to let your systems keep an eye on things themselves - email updates from WSUS in the Microsoft world and package managers in the linux side of things are a good resource, but will often leave you with gaps - WSUS doesn't give you third party software, and package updates may be late, and won't cover software that wasn't installed from the package manager.

Keeping an eye on the announcement channels of vendors will give you a much better picture, but you'll need some research on each.

For those that you've cited:

• Apache HTTP Server: Feed and email
• JBoss: email

There's also the firehose option of the CVE RSS feeds, but that's probably not really what you're looking for on the notifications - but CVE is certainly a great resource for searching for information on a particular product, and the CVSS score that they provide is a good resource for determining how serious the vulnerabilities are.

Watching for "code in the wild" is probably going too far down the rabbit hole for your needs, honestly. I'd recommend placing your trust in your vendors, or else getting new vendors - but if you're determined, then here's a couple resources: the Full Disclosure list and Exploit DB.

Answer 2

Step 1: Subscribe to the -announce and/or -security mailing list for all that you have installed on said server. This way, you'll receive notification as soon as these are made public by the developers. These should be fairly low volume and it's been my experience that if a vulnerability is announced here, you should probably act on it.

Step 2: Subscribe to the bugtraq mailing list: http://www.securityfocus.com/archive. Bugtraq is the best place I can think of for keeping up with vulnerabilities as they emerge. This can be a pain to keep up with as it's a noisy mailing list. Still, it may be worthwhile tracking this list too.

Answer 3

You've got it all wrong. You'll waste more time trying to absorb and filter any news or vulnerability site(s) into something cohesive than you would just getting the updates done. What you are asking for just isn't done in the industry and thus there isn't an easy source filtered by "what you need". Plus, there is the real, ugly, fact that bad guys don't tell us when they take a known, theoretical, threat and make it a live attack.

What you should ask is how a completely underwater systems admin can possibly get back on track updating all their machines, services, and applications. That is something bunches of us have had to do! ;-)

Answer 4

A good listing of known vulnerabilities is the SecurityFocus vulnerability listing. Actual in-the-wild exploits are often listed on the Security Focus news feed and the Packetstorm feeds.

However, I agree with others that only focusing on publically-known vulnerabilities is a waste of time - it's the vulnerabilities that are known to the bad-guys but not the public that are the real danger.

All you can do is make sure all your software stays up-to-date, and rigorously follow best logging- and security-practices.