March 2017. Apache ships a patch for a hole in Struts that lets anyone run commands on your server. Equifax gets the advisory. It also runs a scanner that was supposed to find exactly this, and one public web application still never gets updated. Attackers walk in through it in May and stay for 76 days, leaving with the records of 147 million people. The whole breach comes down to a version number nobody compared properly.
Objective
Return whether an installed version is older than the version that carries the fix.
Steps
$ is_vulnerable({2,3,31}, {2,3,32}, 3)
1
$ is_vulnerable({2,3,9}, {2,3,10}, 3)
1
$ is_vulnerable({2,3,32}, {2,3,32}, 3)
0
Expected files
Allowed functions
None. Write every helper yourself.
Loading solutions...