Introduction to vulnerability management: CVE, CVSS and patching
You learn how a vulnerability is found, named, scored and closed, and you find and patch known vulnerabilities on your own server.
Level 101 · 13 lessons · 15 practice labs
Lessons
Understanding vulnerabilities
- Vulnerability, threat and risk
- CVE IDs and vulnerability databases
- Reading a CVSS score
- CWE: the type of weakness
- Short task: read three CVE records and pick the most dangerous, with reasons
Finding and fixing
- Listing installed package versions
- Reading distribution security advisories
- Installing only security updates
- Restarting after a patch: needrestart
- Short task: install every critical update on the server and verify
Process
- Vulnerability reporting and responsible disclosure
- Zero-days and known vulnerabilities
- Capstone: list, score and close a server’s vulnerabilities
Practice labs
- Read a CVE record and find the affected version: Extract the product, affected version range and fixed version from the given record.
- Turn a CVSS vector into a plain sentence: Read the attack vector, privilege and impact values in the vector and write what the flaw means.
- Choose the most dangerous of three flaws for this server: Weigh the scores together with the server’s exposure and installed version and justify your choice.
- Match a flaw to the right CWE type: Match five flaw descriptions with CWE types such as injection, buffer overflow and access control.
- Compare an installed package version with the advisory: Query the package version, compare it with the fixed version in the advisory and say whether it is vulnerable.
- Install only the security updates and verify: Separate updates from the security repository, install them and show from the version that the package is fixed.
- Find the services that need restarting after a patch: List services using the old library with needrestart, restart them and show the clean output.
- Tell a backported fix from the version number: Find the CVE fix in the changelog of a package whose version looks old and close the false alarm.
- Tell whether a flaw is known or a zero-day: Classify four short incidents as known flaw or zero-day from their advisory and patch dates.
- Write a vulnerability report for responsible disclosure: Prepare a short report describing the flaw you found with impact, reproduction steps and a recommendation.
- List, score and rank a server’s vulnerabilities: Match installed packages with the offline CVE data and rank the top five flaws by score and reachability.
- Explain two different CVSS scores for one flaw and give your own: Compare metric by metric the differing vectors from the vendor and the national database, add environmental metrics for your own server and justify the resulting score.
- Show why two low-scored flaws are dangerous together: Use the vectors and CWE types of an information leak and a missing authorisation flaw to describe their chained impact and set the fix order.
- Split pending updates into security and other: Filter the update list by origin, match security updates to CVE numbers and flag those needing a restart.
- Find the security update skipped because of a held package: Show a held package blocks a security fix, resolve the dependency, apply the patch and prove by version that the flaw is closed.
About this course
You learn how a vulnerability is found, named, scored and closed, and you find and patch known vulnerabilities on your own server.
What you will learn
- Understanding vulnerabilities
- Finding and fixing
- Process
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.