Welcome to DU! The truly grassroots left-of-center political community where regular people, not algorithms, drive the discussions and set the standards. Join the community: Create a free account Support DU (and get rid of ads!): Become a Star Member All Forums Issue Forums Culture Forums Alliance Forums Region Forums Support Forums Help & Search

steve2470

(37,457 posts)
Wed Sep 20, 2017, 08:32 AM Sep 2017

Equifax's disastrous Struts patching blunder: THOUSANDS of other orgs did it too

http://www.theregister.co.uk/2017/09/20/equifax_vulnerability_could_be_widespread/

Thousands of companies may be susceptible to the same type of hack that recently struck Equifax.

The Equifax breach was the result of a vulnerable Apache Struts component. Software automation vendor Sonatype warns that 3,054 organisations downloaded the same Struts2 component exploited in the Equifax hack in the last 12 months. The affected version of Struts2 was publicly disclosed as vulnerable (CVE-2017-5638) on March 10, and was subsequently exploited at Equifax between May and late July, when the attack was finally detected.

Additionally, more than 46,000 organisations downloaded versions of Struts and/or its sub-projects with known vulnerabilities despite perfectly safe versions being available. Altogether, upwards of 50,000 organisations might be vulnerable to attack.

Why are developers still using vulnerable software packages when newer versions are available?
2 replies = new reply since forum marked as read
Highlight: NoneDon't highlight anything 5 newestHighlight 5 most recent replies
Equifax's disastrous Struts patching blunder: THOUSANDS of other orgs did it too (Original Post) steve2470 Sep 2017 OP
Uh, because money ? eppur_se_muova Sep 2017 #1
Stability mostly Egnever Sep 2017 #2

eppur_se_muova

(36,227 posts)
1. Uh, because money ?
Wed Sep 20, 2017, 12:05 PM
Sep 2017

Penny wise & pound foolish gets you to the next quarterly report OK -- until it doesn't.

 

Egnever

(21,506 posts)
2. Stability mostly
Wed Sep 20, 2017, 08:03 PM
Sep 2017

Patches can bring unwanted behavior. Admittedly not taking this one will end up quite costly but typically it is stability they are aiming for and again patches can cause unintended consequences.

Latest Discussions»Help & Search»Computer Help and Support»Equifax's disastrous Stru...