Equifax's disastrous Struts patching blunder: THOUSANDS of other orgs did it too

[steve2470]

http://www.theregister.co.uk/2017/09/20/equifax_vulnerability_could_be_widespread/

Thousands of companies may be susceptible to the same type of hack that recently struck Equifax.

The Equifax breach was the result of a vulnerable Apache Struts component. Software automation vendor Sonatype warns that 3,054 organisations downloaded the same Struts2 component exploited in the Equifax hack in the last 12 months. The affected version of Struts2 was publicly disclosed as vulnerable (CVE-2017-5638) on March 10, and was subsequently exploited at Equifax between May and late July, when the attack was finally detected.

Additionally, more than 46,000 organisations downloaded versions of Struts and/or its sub-projects with known vulnerabilities despite perfectly safe versions being available. Altogether, upwards of 50,000 organisations might be vulnerable to attack.

Why are developers still using vulnerable software packages when newer versions are available?

[eppur_se_muova]

1. Uh, because money ?

Penny wise & pound foolish gets you to the next quarterly report OK -- until it doesn't.

[Egnever]

2. Stability mostly

Patches can bring unwanted behavior. Admittedly not taking this one will end up quite costly but typically it is stability they are aiming for and again patches can cause unintended consequences.