AUTOMATIC ANALYSIS OF THE EXPLOITABILITY OF VULNERABILITY IN A SOFTWARE IMAGE

Description

[0001] The invention relates to methods for automatically analyzing the exploitability of vulnerabilities in a software image executed on a target computer.

[0002] A software image is a representation of a software program that includes all of its components. These components include not only the application program itself, but also software libraries and binaries that are called and executed when the application program runs. The software image can be run directly on a computer's runtime environment. Software images can also be created and executed as container images using container virtualization, for example, in cloud environments. For ease of reading, the abbreviation SW will be used synonymously with the word "software" in the following text.

[0003] Container virtualization is a method in which multiple instances of an operating system can use the same operating system kernel on a guest computer in isolation from one another. Software containers, hereinafter referred to simply as containers, thus represent a lightweight way of virtualizing a runtime environment on a guest computer, also called a host system, and encapsulate a software application running in a container from the underlying host system. Software applications are now implemented using containers in many areas, for example in industrial automation and process control, but also in transportation systems and building automation.

[0004] To start a container on the host system, a container image is required, which contains not only the application software but also the necessary binaries and libraries. A container, or more precisely, a container instance, is created from the container image on the host system and executed in the host system's runtime environment.

[0005] The software composition of container instances no longer changes during runtime. The same applies to software applications on non-containerized devices that are installed via pre-built software images, whose configuration and composition do not change after installation. Examples of this are: z.B. Cloud instances are typically not patched, but instead completely rebuilt using new operating system images. Other examples include devices like switches or firewalls, onto which a pre-built firmware is installed. The firmware is usually not patched; instead, the software version is installed by flashing the complete firmware.

[0006] Although the software image is always loaded onto the device's runtime environment with the same software components, not all software components need to be activated in the runtime environment. This can be due to different runtime environment configurations, such as license keys, which may prevent the use of certain components.

[0007] US 2017 / 0109536 discloses a method for detecting vulnerabilities in a base image of software containers. Upon receiving an event, the content of the base image is extracted, and a detection event is generated if a vulnerability is found.

[0008] US 9,400,889 B2 discloses a method for automatically analyzing the exploitability of vulnerabilities in the source code or executable code of software. An attack management module identifies potential vulnerabilities in the code through static analysis. A fault injection module processes the identified vulnerabilities to apply vulnerability tests to the software. The fault injection module systematically tests vulnerable parts of the code for known and user-defined attacks. For example, it applies exploits against input fields, cookies, headers, and the like. The code's performance under these conditions is then analyzed, and the results are communicated to the user.

[0009] CN 111 259 406 A discloses the creation of a container image containing a software image to be analyzed and exploits to be applied to the software image. The container image is then executed in a runtime environment to determine whether the software image to be analyzed is vulnerable to the exploits.

[0010] US 2016 / 314302 A1 discloses the execution of a container image in various configurations of a target computer's runtime environment. Exploits are then injected into the container to determine in which runtime environment configurations the container image is vulnerable to the exploits.

[0011] This creates the problem that while vulnerabilities and thus security gaps of a software image are known, it is not known whether these known security gaps can also be exploited in the runtime environment of a specific device.

[0012] It is therefore an object of the present invention to provide a method in which the usability of a SW image installed on a specific target device can be determined and exchanged quickly and with little effort.

[0013] The problem is solved by the measures described in the independent claims. Advantageous embodiments of the invention are described in the dependent claims.

[0014] According to a first aspect, the invention relates to a method for automatically analyzing the exploitability of vulnerabilities in a software image executed on a target computer, comprising Identifying all software components contained in the software image, determining vulnerabilities of the identified software component for each software component of the software image using a vulnerability database, determining all exploits associated with the at least one identified vulnerability of the software component for each identified software component using an exploit database, assigning the identified exploits to the software image, and executing the software image and the exploits associated with the software image on a runtime environment configuration specific to the target computer, confirming the exploitability of the at least one identified vulnerability on the specific runtime environment configuration if executing the at least one exploit leads to exploitation of the vulnerability, using a modified,A non-exploitable software image is created depending on a policy stored in the manufacturer's assembly device for assembling the software image and depending on at least one confirmed exploitable vulnerability, and the modified software image is provided to one or all target computers that have the specific runtime environment configuration.

[0015] In electronic data processing, an exploit is a systematic way to take advantage of vulnerabilities that arose during the development of a program. The exploit comprises program code that, when applied to the software component, exploits vulnerabilities, such as security gaps and malfunctions, usually to gain access to resources or to penetrate or impair the target computer. Thus, all vulnerabilities and the exploits necessary to test their exploitability can be systematically compiled for a given software image. This enables targeted testing of the exploitability of the software image's vulnerabilities on the runtime environment of the target computer on which the software image is installed.If a vulnerable software component of the software image is not activated and therefore not executed on the runtime environment specific to the target computer, the vulnerability cannot be exploited in that specific configuration. The software image can then be executed without security issues. Thus, only those vulnerabilities that can actually lead to security gaps and malfunctions of the software component on the target computer's specific runtime environment configuration are confirmed as exploitable.

[0016] In an advantageous embodiment, the at least one exploitable vulnerability is reported to a user of the target computer and / or a manufacturer of the software image.

[0017] Thus, the procedure only reports cases to the user of the target computer or the manufacturer of the software image that are actually problematic for the individual target computer.

[0018] In an advantageous embodiment, the process steps are carried out after the SW image has been assembled at the manufacturer and / or at predetermined time intervals and / or after predetermined events.

[0019] By performing this procedure after assembling the software image, the manufacturer can, for example, be alerted that the software image contains exploitable vulnerabilities in the target computer's runtime environment configuration, and an update of the software image can be automatically triggered. Following predefined events, such as the availability of a new version or patches of the software image, an exploitability check can be automatically performed for the target computer's specific runtime environment configuration, and the new version can only be installed if no exploitable vulnerability is reported.

[0020] In an advantageous embodiment, a modified, non-exploitable SW image is created depending on a guideline stored in an assembly device of the manufacturer for assembling the SW image and depending on the at least one confirmed exploitable vulnerability.

[0021] The policy stored in the build system allows for the systematic remediation of confirmed exploitable vulnerabilities and the creation of a modified software image in which the identified and exploitable vulnerabilities are either removed or rendered unexploitable. This policy enables the modified software image to be created fully or at least partially automatically.

[0022] In an advantageous embodiment, the modified software image is provided, in particular on a software repository, and automatically installed on the target computer.

[0023] Thus, the modified software image can be automatically installed on the target computer as a published patch.

[0024] In an advantageous embodiment, the modified SW image is provided, in particular on a software repository, and the modified SW image is automatically deployed to other target computers with the same specific configuration of the runtime environment.

[0025] This means that not only one target system, but all or at least multiple target systems with the same runtime environment configuration can be updated and thus protected against attacks. An exploitability analysis does not need to be performed again for each additional target system.

[0026] In an advantageous embodiment, the software components and their weaknesses are identified on a reference computer or on an assembly device of the manufacturer.

[0027] Identifying the software components on the assembly device has the advantage that information about the software components contained in the software image is available quickly and with little or no additional effort. Furthermore, a list of the software components and their vulnerabilities can be provided with each released software image. Determining this on a reference machine has the advantage of being done before the software image is actually installed on the target machine.

[0028] In an advantageous embodiment, the software components are identified depending on a signature of the software component or by means of a package manager within the software image.

[0029] The package manager is typically included in a software image, so there are hardly any modifications or additional efforts required to locate it. Identifying it based on the software component's signature is reliable and also allows for an integrity check of the software component.

[0030] In an advantageous embodiment, additional manufacturing information, in particular a version identifier, is determined for at least one identified software component.

[0031] This allows for differentiation between different variants of the software component and faster identification of known vulnerabilities for each variant.

[0032] In an advantageous embodiment, a vulnerability profile specific to the SW image, comprising the identified SW components, the identified vulnerabilities and the identified exploits, is stored in an image vulnerability database.

[0033] When installing the software image on another target computer, the exploitability of the software image on the specific configuration of the additional target computer can be checked by retrieving the software image-specific vulnerability profile from the image vulnerability database, without having to redefine the software components, vulnerabilities, and exploits. This enables a time- and computationally efficient exploitability check.

[0034] In an advantageous embodiment, different configurations of runtime environments, preferably with the correspondingly configured target computers on which the software image is executed, are determined using an inventory database.

[0035] This allows for the easy identification of different runtime environment configurations and the exploitability of vulnerabilities in the software image on the given configuration to be checked before or during the software image's runtime. Ideally, the inventory database also assigns and stores the individual, appropriately configured target computers along with the runtime environment configurations.

[0036] In an advantageous embodiment, the configuration of the runtime environment of the target computer on which the software image is executed is determined by the target computer and transmitted to an inventory database.

[0037] This is preferably determined using an additional function, for example in the form of a plugin, or by an agent running on the target computer within the runtime environment. This allows the target computer to independently report its configuration to the runtime environment.

[0038] In an advantageous embodiment, the configuration of the runtime environment of the target computer on which the software image is executed is determined by a configuration scanner and transmitted to the inventory database.

[0039] This allows the runtime environment configuration to be determined even for target computers without an agent or plugin. Target computers do not need to be extended, and non-extendable target computers can still be recorded in the inventory database.

[0040] In an advantageous embodiment, the configuration scanner determines the configuration of the runtime environment of the target computer depending on open services on the target computer, response messages from the target computer to queries sent to the target computer, or an identifier of the target computer.

[0041] According to a second aspect, the invention relates to a system for the automatic analysis of the exploitability of vulnerabilities of a software image executed on a target computer, comprising an analysis unit that is designed in this way. to identify all software components contained in the software image, to determine the vulnerabilities of the identified software component for each software component of the software image using a vulnerability database, to determine all exploits associated with the at least one identified vulnerability of the software component for each identified software component using an exploit database, and to assign the determined exploits to the software image, and to provide a verification unit trained in this manner, and a test unit trained in this manner, to execute the software image and the exploits associated with the software image on a runtime environment configuration specific to the target computer, and to confirm the exploitability of the identified vulnerabilities on the specific runtime environment configuration if executing the at least one exploit leads to the exploitation of the vulnerability.and to report the exploitable vulnerabilities to a user of the target computer and / or a manufacturer of the software image, whereby a modified, non-exploitable software image is created depending on a policy stored in a manufacturer's assembly device for assembling the software image and depending on the at least one confirmed exploitable vulnerability, and the modified software image is provided to one or all target computers that have the specific configuration of the runtime environment.

[0042] In one embodiment, the system further comprises an image vulnerability database designed to store a SW image-specific vulnerability profile encompassing the identified SW components, the identified vulnerabilities, and the identified exploits.

[0043] The system according to the invention enables an automatic exploitability check to be performed, i.e., it can be checked whether identified vulnerabilities can actually be used for an attack on the target computer with the specific configuration of its runtime environment.

[0044] A third aspect of the invention relates to a computer program product comprising a non-volatile, computer-readable medium that can be directly loaded into a memory of a digital computer, comprising program code segments which, when executed by the digital computer, cause it to perform the steps of the method.

[0045] Unless otherwise specified in the following description, the terms "detect," "assign," "execute," "confirm," "report," and the like refer preferably to actions and / or processes and / or processing steps that modify and / or generate data and / or convert data into other data, wherein the data is represented or may exist as physical quantities, for example, as electrical impulses. The system and optionally included components, such as an image vulnerability database, a vulnerability database, an exploit database, an inventory database, target computers, and the like, may comprise one or more processors. A processor may, in particular, be a main processor (i.e., a CPU).Central Processing Unit (CPU), a microprocessor or microcontroller, for example an application-specific integrated circuit or a digital signal processor, possibly in combination with a memory unit for storing program instructions, etc.

[0046] A computer program product, such as a computer program tool, can be provided or delivered from a server in a network, for example, as a storage medium such as a memory card, USB stick, CD-ROM, DVD or as a downloadable file.

[0047] Exemplary embodiments of the method and arrangement according to the invention are shown in the drawings and are explained in more detail below. The drawings show: Fig. 1 shows an embodiment of the method according to the invention as a flowchart; Fig. 2 shows a first embodiment of the system according to the invention in schematic representation; and Fig. 3 shows a second embodiment of the system according to the invention with automatic updating of the SW image on further target computers in schematic representation.

[0048] Corresponding parts are marked with the same reference symbols in all figures.

[0049] Software images potentially contain vulnerabilities that can be identified using analysis tools. However, a fundamental problem is the need for automated exploitability testing, which determines whether these vulnerabilities can actually be used for an attack. This problem arises for all software images, but especially for container images, as these allow for a seamless transition from static analysis of the container image to dynamic verification of its exploitability.

[0050] In Figur 1 The individual steps of the proposed procedure are described below. In the first step, S1, all software components of a software image are identified, and vulnerabilities in each identified component are determined by querying a vulnerability database (see step S2). This database contains known vulnerabilities of software components. The software components and their vulnerabilities are preferably identified on a reference computer or on an assembly device provided by the software image manufacturer. In step S3, all exploits associated with the identified vulnerabilities of the software components are determined using an exploit database and assigned to the software image in step S4.This approach assumes that at least one vulnerability is identified in the software image and that the exploit database contains at least one exploit for each known software vulnerability. The exploits associated with the vulnerabilities can then be queried from the vulnerability database to the exploit database.

[0051] The software image and the exploits associated with it are then executed on a runtime environment configuration specific to the target computer, see procedure step S5. If executing the exploit results in exploitability, d.h. If this enables unintended access to the runtime environment, the exploitability is confirmed (see procedure step S6) and the confirmed exploitable vulnerability is reported to at least one user of the target computer and / or a manufacturer of the software image (see S7).

[0052] By executing the exploits in the software image's runtime environment, it's possible to verify whether the vulnerability can be exploited on precisely the one chosen runtime environment configuration specific to the target machine. The at least one vulnerability confirmed as exploitable is then reported to all users of target machines with the same runtime environment configuration. The user can then take appropriate action, such as discontinuing execution of the software image and / or installing a modified, non-exploitable version of the software image.

[0053] The at least one exploitable vulnerability is additionally or exclusively reported to the manufacturer or developer of the software image. This informs the manufacturer of the urgency of addressing the vulnerability or allows them to determine the urgency themselves. A modified, non-exploitable software image can be created, depending on a policy stored in the manufacturer's build system and depending on the at least one confirmed exploitable vulnerability. This newly created, modified software image is then made available to one or all target computers that have the specific runtime environment configuration. The modified software image is stored, for example, in a software repository and can be retrieved from there by the target computer or automatically deployed to one or more target computers.

[0054] The analysis of the software image for vulnerabilities and their exploitability can be performed, for example, after the software image has been created, particularly after the software image has been assembled. Since further vulnerabilities in the software image are discovered over time, the process steps are preferably repeated at predetermined intervals or after predetermined events, such as the discovery of a new vulnerability, for the same software image.

[0055] Figur 2 A system 10 for the automatic analysis of software images regarding the exploitability of vulnerabilities on a target computer was described. The system 10 is configured to execute the described procedure. The system 10 comprises an analysis unit 11 and a test unit 16. The analysis unit 11 includes a reference computer or assembly device 12 configured to execute the software image, on which the individual software components of the software image are identifiable and all vulnerabilities of each of the identified software components can be determined. The analysis unit 11 includes a component scanner 13, which identifies the software components of the software image.Analysis system 11 further comprises a vulnerability database 14, in which the vulnerabilities of the software components are stored, and an exploit database 15, in which at least one exploit for each vulnerability is stored, with which the exploitability of the vulnerability on a software image can be verified. Analysis unit 11 is configured to assign the identified exploits to the software image.

[0056] Test unit 16 comprises a runtime environment 17, which corresponds to the configuration of a runtime environment on the target computer. Test unit 16 is configured to execute the software image and the exploits associated with it. If executing the exploits results in the vulnerability on the test unit being exploited and test unit 16 becoming vulnerable via this vulnerability—for example, if it can be modified or controlled improperly—test unit 16 will report this exploitability to a user or the vendor of the software image. Test unit 16 includes, for example, an output interface for this purpose.

[0057] A further embodiment of the method for automatic exploitability analysis is described using a system 20 shown in Figure 4, in which software images are automatically checked for a large number of target computers 31, for example, in a data network. The system 20 comprises an analysis unit 21 and a test unit 22 with a software image 23, which is stored in a reference computer or assembly device, a component scanner 24, a vulnerability database 25, an exploit database 26, an image vulnerability database 27, an inventory database 28, a configuration scanner 29, and a software repository 30.

[0058] The software image 23 of a software application, which comprises several software components and exists either encapsulated as a container image or in non-encapsulated form, is generated, for example, in an assembly device within a continuous integration and delivery process, also known as a CI / CD pipeline. The assembly device is not part of the system 20. After the software image 23 is generated, it is installed on the analysis unit 21. The software components of the software image 23 are identified using the component scanner 24. The component scanner 24 can operate as a standalone unit or be integrated into the assembly device. The software image 23 is provided to the component scanner 24 either centrally in an image repository or locally. During the identification of the software components, additional manufacturing information, in particular a version identifier, is determined.The component scanner 24 thus creates a component list, including the version of each component, for the software image 23. The software components can be identified using a package manager within the software image 23 or, for example, based on a software component signature.

[0059] Once the component list is created, it is compared with the vulnerability database 25. Based on the identified software components, the software image is then assigned the vulnerabilities it contains. The exploit database 26, which is optionally integrated into the vulnerability database 25, contains at least one exploit for each vulnerability, providing information on how to verify the vulnerability. An exploit might include, for example, a sequence of commands on the runtime environment or a query on an externally accessible interface.

[0060] Based on the detected vulnerabilities, the vulnerability scanner 24 writes a vulnerability profile specific to the software image, which includes the identified software components, the determined vulnerabilities, and the determined exploits, to the image vulnerability database 27. Saving the software image-specific vulnerability profile to the image vulnerability database 27 can occur at predefined intervals, for example, cyclically or event-driven, such as with each software image build within the CI / CD pipeline.

[0061] Different runtime environment configurations are determined using an inventory database 28. This inventory database 28 stores information about which runtime environment configurations operate which software images 23 and how these are accessible on the data network. A runtime environment is deployed on a target computer. The inventory database also provides information about the target computers 31 running each runtime environment configuration and how these are accessible on the data network.

[0062] The inventory database 28 is kept up-to-date in two ways.

[0063] In one embodiment, the configuration of the runtime environment of the target computer 31, on which the software image 23 is executed, is determined by the target computer 31 and transmitted to an inventory database 28. This means that the underlying runtime environment of the target computer 31 reports the software images active on that runtime environment using an additional module, such as a plugin or an agent running on the system. The update can occur either periodically or event-driven, for example, when a container instance is started or stopped from a container image.

[0064] In another embodiment, the software image 23 on a target computer 31 is identified by the configuration scanner 29 by externally executing targeted actions. This involves checking whether certain services are open, whether specific server strings are provided (e.g., during queries), or whether the MAC addresses and the manufacturer information encoded therein are evaluated. The configuration scanner 29 thus determines the configuration of the target computer's runtime environment based on open services on the target computer 31, response messages from the target computer 31 to queries sent to it, or an identifier of the target computer 31. The configuration scanner 29 must use a process of elimination, employing specific tests, to determine which software image is potentially running on the target computer 31.

[0065] Once the inventory database 28 with the associated software images has been created, specific vulnerability tests can be performed periodically or upon the publication of critical vulnerabilities for each stored software instance (i.e., container instance or conventional, non-encapsulated software instance) and its associated software image using the configuration scanner 29. This allows the system to determine whether the vulnerabilities provided in the software image are actually exposed, i.e., actively exploited on the target computer. In this embodiment, the target computer itself corresponds to the test unit (see test unit 16 in [reference]). Fig.2 , on which the exploits are executed and thus it is verified whether the vulnerability is actually exploitable.

[0066] If a vulnerability is detected as exploitable, an alert is triggered via a reporting / alerting component, preferably on target machine 31, and the result is sent back to the software image manufacturer, specifically to a build component for the image. This provides the software image developer with feedback that the software image contains vulnerability information in a specific runtime environment configuration and that this information is exploitable. Alternatively or additionally, an update of the software image is automatically initiated, updating the identified software component by automatically applying a published patch to the target machine(s) 31. Furthermore, other recommended configuration changes identified in connection with the vulnerability can be implemented in the runtime environment of the target machine(s) 31, or the latest version can simply be installed on them.

[0067] Once a new software image version is available, it can be made available in the software repository and thus published, and measures can be taken to ensure that affected runtime environments or target computers are given priority access to the new software image version without vulnerabilities.

[0068] The described method and system allow vulnerabilities to be identified not only based on the software image, but also verified through targeted tests on externally exposed services in the runtime environment. The configuration scanner 29 can inform the developer which target computers 31 should be prioritized for receiving new software images. Automated builds can generate new software images by selectively implementing recommended measures, such as installing a newer software version. For target computers containing particularly critical software images, it can be determined which target computers should be prioritized for patching, i.e., updating, by installing a new software image.

[0069] All process steps can be implemented by the appropriate devices suitable for executing the respective process step. All functions that can be performed by the features described can constitute a process step of the process. All described and / or drawn features can be advantageously combined within the scope of the invention. The invention is not limited to the described embodiments.

Claims

1. Method for the automatic analysis of the exploitability of vulnerabilities of a software image (12, 23) executed on a target computer (31), comprising - identifying (S1) all software components contained in the software image, - determining (S2) vulnerabilities of the identified software component for each software component of the software image (12, 23) using a vulnerability database (14, 25), - determining (S3) all exploits associated with the at least one determined vulnerability of the software component, for each identified software component, using an exploit database (15, 26), - associating (S4) the determined exploits with the software image (12, 23), and - executing (S5) the software image (12, 23) and the exploits associated with the software image (12, 23) on a configuration of a runtime environment specific to the target computer (31), and - confirming (S6) the exploitability of the at least one identified vulnerability on the specific configuration of the runtime environment (31) if the execution of the at least one exploit leads to exploitation of the vulnerability, wherein a modified, non-exploitable software image is created depending on a policy stored in a manufacturer's assembly device for assembling the software image and depending on the at least one confirmed exploitable vulnerability, and the modified software image is provided to one or all of the target computers that have the specific configuration of the runtime environment.

2. Method according to Claim 1, wherein the at least one exploitable vulnerability is reported to a user of the target computer (31) and / or to a manufacturer of the software image (S7) .

3. Method according to either of the preceding claims, wherein the method steps are carried out after assembly of the software image (12, 23) at the manufacturer and / or at predetermined time intervals and / or after predetermined events.

4. Method according to Claim 1, wherein the modified software image is provided on a software repository (30).

5. Method according to Claim 1 or 4, wherein the modified software image is retrieved by the target computer or automatically imported into the target computer (31).

6. Method according to Claim 1 or 4, wherein the modified software image is automatically imported into further target computers (31) with the same configuration of the runtime environment.

7. Method according to any of the preceding claims, wherein the software components and their vulnerabilities are identified on a reference computer (17) or on a manufacturer's assembly device.

8. Method according to any of the preceding claims, wherein the software components are identified depending on a signature of the software component or by means of a package manager within the software image (12, 23).

9. Method according to any of the preceding claims, wherein additional manufacturing information, in particular a version identifier, is determined for the at least one identified software components.

10. Method according to any of the preceding claims, wherein a vulnerability profile, specific to the software image and comprising the identified software components, the determined vulnerabilities and the determined exploits, is stored on an image vulnerability database (27).

11. Method according to any of the preceding claims, wherein different configurations of runtime environments, preferably with the correspondingly configured target computers (31) on which the software image is executed, are determined by means of an inventory database (28).

12. Method according to Claim 11, wherein the configuration of the runtime environment of the target computer (31), on which the software image is executed, is determined by the target computer (31) and transmitted to an inventory database (28).

13. Method according to Claim 11, wherein the configuration of the runtime environment of the target computer (31), on which the software image (12, 23) is executed, is determined by a configuration scanner (29) and transmitted to the inventory database (28).

14. Method according to Claim 13, wherein the configuration scanner (29) determines the configuration of the runtime environment of the target computer (31) depending on open services on the target computer (31), response messages of the target computer (31) to queries directed to the target computer (31), or an identifier of the target computer (31).

15. System (20) for the automatic analysis of the exploitability of vulnerabilities of a software image (12, 23) executed on a target computer (31), comprising an analysis unit (11, 21), which is designed to - identify all software components contained in the software image (12, 23), - determine vulnerabilities of the identified software component for each software component of the software image (12, 23) using a vulnerability database (14, 25), - determine all exploits associated with the at least one determined vulnerability of the software component, for each identified software component, using an exploit database (15, 26), - associate the determined exploits with the software image (12, 23), and a test unit (12, 22), which is designed to - execute the software image (12, 23) and the exploits associated with the software image (12, 23) on a configuration of a runtime environment specific to the target computer (31), - confirm the exploitability of the at least one identified vulnerability on the specific configuration of the runtime environment if the execution of the at least one exploit leads to exploitation of the vulnerability; wherein a modified, non-exploitable software image is created depending on a policy stored in a manufacturer's assembly device for assembling the software image and depending on the at least one confirmed exploitable vulnerability, and the modified software image is provided to one or all of the target computers that have the specific configuration of the runtime environment.

16. Computer program product, comprising a non-volatile computer-readable medium which can be loaded directly into a memory of a digital computer, comprising program code parts which when they are executed by the digital computer cause said computer to carry out the steps of the method according to any of Claims 1 to 14.