Unit 10: Packages, signatures and patching · Lesson 4 of 5 · 22 min

Case file: the patch that was not applied

A two-month-old fix for a web upload library would have prevented one of the largest breaches. Find web01's pending security update.

mission

You are
You are running web01's patch review.
Situation
The shop-forms library parses uploads on the public site. The platform team says updates install automatically.
Goal
Find pending updates, read why they matter and check whether automatic updates would install them.
Hand in
Pending security updates, their age and the change that applies them.

case file

Equifax Breach

Equifax · 2017

Attackers exploited a publicly disclosed Apache Struts vulnerability in Equifax's internet-facing online dispute portal and stayed for months, exposing personal data of roughly 147 million people. The intrusion was spotted only after Equifax renewed an expired certificate on a traffic-inspection device, which immediately revealed suspicious traffic. Equifax later agreed to a global settlement of up to $425 million with the FTC, CFPB and US states.

What went wrong

The March 2017 Struts patch was not applied to the dispute portal (a follow-up scan missed the vulnerable system), and the device that inspected the portal's network traffic had been inactive for about 19 months because its certificate had expired.

What would have stopped it

  • Maintain an accurate asset and software-component inventory so every internet-facing instance of a vulnerable library is found and patched, then verify the patch rather than relying on a single scan.
  • Track expiry of certificates used by security tooling (TLS inspection, IDS) and alert well before expiry; treat a silent monitoring device as an incident.
  • Segment sensitive databases from internet-facing applications and restrict which credentials the web tier can use.

What defenders could have seen

  • Health/heartbeat alert when a network inspection sensor stops producing events.
  • Vulnerability scan or SBOM match showing the vulnerable Struts version on a public host after the patch deadline.
  • Unusual outbound data volumes or database queries originating from the dispute portal servers.

sourcestechtarget.comgao.govftc.gov

The patch window

  1. Fix published8 September
  2. Target48 hours for internet-facing hosts
  3. Still pendingSix weeks later
  4. Breach windowEvery day in between
01

List what is waiting

This lab only has the company repository's index, so only in-house packages show.

learner@root-lab
apt list --upgradable 2>/dev/null
Listing...
shop-forms/stable 3.1.1 all [upgradable from: 3.1.0]

you should see shop-forms 3.1.1.

02

Read why

learner@root-lab
dpkg-deb --fsys-tarfile /srv/mirror/pool/shop-forms_3.1.1_all.deb | tar -xO ./usr/share/doc/shop-forms/changelog.gz | zcat
shop-forms (3.1.1) stable; urgency=high
  * Security: fix unsafe parsing of the Content-Type header in uploads
    that allowed remote code execution (advisory SHOP-SA-2026-07).
  * Published 2026-09-08. Patch within 48 hours on internet-facing hosts.

you should see A remote code execution fix published on 8 September, with a 48-hour target.

03

Would it install on its own?

learner@root-lab
apt-config dump | grep -E 'Periodic::(Update|Unattended)'
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "0";
apt-config dump | grep -A1 Origins-Pattern
Unattended-Upgrade::Origins-Pattern "";
Unattended-Upgrade::Origins-Pattern:: "origin=Ubuntu,archive=noble-security";
Unattended-Upgrade::Automatic-Reboot "false";

you should see Automatic upgrades are switched off, and the allowed origins list Ubuntu only.

04

Apply it in production

On a real server: sudo apt-get install --only-upgrade shop-forms, then confirm with dpkg -l shop-forms. Six weeks have passed since a fix with a 48-hour target.

you should see 3.1.1 installed and the service restarted.

defender tip Patch internet-facing systems first, scan afterwards to confirm the new version is running, and track every miss.

Automatic updates

Today
APT::Periodic::Unattended-Upgrade "0";
Origins: Ubuntu security only

In-house fixes never install themselves

Fixed
APT::Periodic::Unattended-Upgrade "1";
Origins: Ubuntu security
         + origin=Shop Example

Security fixes from both sources install nightly

What a defender takes away

  1. 1Know what is pending and why.
  2. 2Check that automatic updates cover every repository you use.
  3. 3Verify after patching; a scan that misses one host misses everything.

Questions

0 of 3 solved

Answer each one from what you find on your lab machine.