Solaris Paste Scan#
Beta
Solaris paste scan is provided as a beta feature. Detection results may contain errors. If you notice any issues, please contact our User Support.
By registering Oracle Solaris package information through the FutureVuls console, you can detect vulnerabilities without using a scanner. Solaris can be registered only by paste scan (scanning with a scanner is not supported).
For supported versions, see "Supported Environments".
How Vulnerabilities Are Detected#
FutureVuls detects vulnerabilities by matching the registered package information against the vulnerability information published by Oracle (the Solaris advisories in the Critical Patch Update and the Oracle Solaris Third Party Bulletin). How FutureVuls determines whether a vulnerability has been fixed differs by version.
| Version | How Fixes Are Determined |
|---|---|
| 11.3, 11.4 | Determined from the update level (SRU / ESU) included in the version of the entire package |
| 11.0, 11.1, 11.2 | Because the update levels that contain fixes are not published, estimated from the timestamp (build date) in the version of the entire package and the publication date of the vulnerability information |
| 10 | Not determined. All vulnerabilities that may affect the installed packages are detected |
For Java 8 and MySQL on Solaris 11, FutureVuls determines whether a vulnerability has been fixed not from the entire package but from the version of each package and the range of affected versions published by Oracle.
Detection results for Solaris 10
For Solaris 10, there is no public information that indicates whether a vulnerability has been fixed based on the patches applied, so detection results remain even after you apply patches. Check which patches have been applied in your environment, and update the task statuses accordingly.
Because detection is based on public information, the following limitations apply:
- Vulnerabilities that Oracle does not publish in its public information cannot be detected.
- For vulnerabilities whose public information does not state the update level that fixes them, FutureVuls cannot determine whether they have been fixed, so they may continue to be detected after you update.
- For Solaris 11.3, vulnerabilities in components not covered by Extended Support are not detected.
Required Information and How to Obtain It for Solaris Paste Server Registration#
Follow the steps in "How to Register a Paste Scan", select "Solaris" for OS Family, and enter the following information.
| Info | Version | Command |
|---|---|---|
| OS Version | - | Check the output of head -1 /etc/release, and then select 10 or one of 11.0 to 11.4 |
| Kernel Release | - | uname -r |
| Kernel Version | - | uname -v |
| Packages | 11.0 to 11.4 | pkg list -Hv |
| Packages | 10 | /usr/bin/pkginfo -x |
- Run the package list command exactly as shown in the table (do not add arguments such as package names) and paste the entire output. An empty package list cannot be registered.
- For Solaris 11, the package list must include the
entirepackage. Servers from which theentirepackage has been uninstalled cannot be registered.
If you update packages, update the configuration information by following the steps in "Updating a Paste Server".