Threats, Vulnerabilities, and Attacks · Topic 5 of 10
System and Software Vulnerabilities
Security+ vulnerabilities: unsupported, unpatched and obsolete systems, open ports, race conditions, hardcoded secrets, VM escape, zero-days, weak crypto.
- 5 min
- Unsupported means no more fixes. Unpatched means a fix exists but is not applied.
- Obsolete systems lack modern protections, and unmanaged systems are invisible to security tools.
- Close ports and disable services that are not needed.
What it is
A vulnerability is a weakness that an attacker can use to harm a system. The attack surface is the sum of all the places where an attacker could try to get in or take data out.
This page covers weaknesses in systems and software: their support status, exposed services, application and code flaws, operating systems, virtualization, zero-day flaws and cryptography. The next page covers credentials, devices, cloud and other exposures.
How it works
System state
| Vulnerability | Meaning | Usual response |
|---|---|---|
| Unsupported products | The vendor no longer provides security fixes | Replace, or isolate and add compensating controls |
| Unpatched systems | A fix exists but has not been applied | Patch on a regular, tested schedule |
| Obsolete systems | Old technology that lacks modern security features, even if it still runs | Plan replacement, isolate in the meantime |
| Unmanaged systems | Devices outside inventory, patching and monitoring tools | Discover them, bring them under management or remove them |
The difference between unsupported and unpatched matters. An unpatched system can be fixed today, while an unsupported one will never get a fix for new flaws.
Ports and services
Every listening port is a service an attacker can try to reach. Services that are not needed, or that use old unencrypted protocols, add risk without value.
Close unused ports, disable unneeded services and restrict the rest to the networks that need them. Regular scans show what is actually exposed.
Application vulnerabilities
A race condition happens when the outcome depends on timing. The classic form is time-of-check (TOC) versus time-of-use (TOU): the system checks a condition, and the condition changes before the result is used.
For example, a program checks that a user may open a file, then the attacker replaces it with a link to a protected file before the program opens it. Locking the resource, or checking and using it in a single step, removes the gap.
A malicious update is a software update that contains malware but arrives through a channel the user trusts. Code signing and verifying update integrity help, but a compromised vendor can still sign bad code.
Code vulnerabilities
| Vulnerability | Meaning | Fix |
|---|---|---|
| Hardcoded secrets | Passwords, keys or tokens written into source code or configuration files | Store secrets in a vault or secrets manager, scan code for secrets, rotate any that leak |
| Unsafe exception handling | Errors that reveal stack traces, paths or queries, or that leave the program in an insecure state | Show generic error messages, log details privately, fail securely |
Hardcoded secrets are dangerous because anyone who sees the code, including in a public repository, gains the access. Failing securely means that an error denies access rather than allowing it.
Operating system-based vulnerabilities
These are flaws in the core system software, such as kernel bugs, weak default settings and unnecessary components. The usual fix is to apply vendor patches promptly and harden the configuration with a secure baseline.
Virtualization vulnerabilities
| Issue | Meaning |
|---|---|
| VM escape | An attacker breaks out of a virtual machine (VM) and reaches the hypervisor or other VMs |
| Resource reuse | Memory or storage released by one VM is given to another without being cleared |
| VM sprawl | Too many VMs are created and left unmanaged, unpatched and forgotten |
A flaw in the hypervisor is serious because it can affect every VM on the host. Patch hypervisors quickly and keep an inventory of VMs.
Zero-day vulnerabilities
A zero-day is a flaw that is unknown to the vendor, or has no patch yet. Attackers can use it until it is found and fixed.
Because patching is not possible, defense relies on layers: segmentation, least privilege, behavior based detection and fast response.
Cryptographic vulnerabilities
Cryptography fails when it uses old algorithms, short keys, poor random number generation, badly managed keys or a flawed implementation. Old protocol versions may also allow a downgrade to a weaker setting.
The fix is to use current, well reviewed algorithms and protocol versions, retire old ones and protect keys.
What to remember for the exam
- Unsupported means no more fixes. Unpatched means a fix exists but is not applied.
- Obsolete systems lack modern protections, and unmanaged systems are invisible to security tools.
- Close ports and disable services that are not needed.
- A race condition is a timing flaw between time-of-check and time-of-use.
- A malicious update arrives through a trusted channel.
- Hardcoded secrets belong in a vault, not in code.
- Unsafe exception handling leaks details or fails open.
- VM escape breaks VM isolation. A zero-day has no patch, so use layered defenses.
If the question says the vendor has ended support for a system that cannot be replaced yet, the answer is isolation plus compensating controls.
Common mistakes
Thinking patching solves a zero-day. By definition no patch exists yet, so compensating controls are needed.
Confusing unsupported with unpatched. One can be fixed now, the other cannot.
Hiding secrets by obscurity. A key buried in compiled code or a config file can still be extracted.
Confusing VM escape with VM sprawl. One is an attack that breaks isolation. The other is an operations problem of too many unmanaged machines.
Showing detailed errors to users. Stack traces and database errors help an attacker map the system.
Check yourself
What is the difference between an unsupported system and an unpatched system?
An unsupported system no longer receives fixes from the vendor, while an unpatched system has a fix available that has not been applied.
What is a time-of-check to time-of-use flaw?
A race condition in which a condition changes between being checked and being used.
Where should application secrets be stored instead of in source code?
In a secrets manager or vault, with access controlled and secrets rotated.
Topic 5 of 10 in Threats, Vulnerabilities, and Attacks
Test yourself on Threats, Vulnerabilities, and Attacks
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.