Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

More specifically, if a website is using an application already known to have a flaw as part of the larger service it offers (so, say it's using a version of Apache known to have a flaw, and the continued presence of that flaw has been confirmed by the researcher), does that fall under the definition?

More to the point, could it be sold as such to, for example, ZDI (I couldn't find a good definition from their site).

(To clarify, I haven't found anything. Just curious whether, if I did, it would be a better use of my time to e-mail the admin directly, or sell the information to a security company which would deal with the (possibly indignant, probably negligent, hypothetically personally insulting) admin for me.)

share|improve this question
    
So, would finding an SQLi vuln in someone's cat blog count by definition (though, granted, I'll admit that'd be stretching it a bit). –  root Mar 28 '13 at 3:14

4 Answers 4

up vote 5 down vote accepted

A 0-day exploit is a vulnerability not known to the public and more particular, the programmers of a particular application.

You don't want to get that confused with bad coding. If someone created a button that said "Click here for admin access", and it would grant admin access, this would not be a 0-day vulnerability.

Most programmers would agree that having this button would be bad and could tell the original programmer the implications of their code.

Lets hypothetically assume that all programmers think this button is okay to have. Of course we know this is a vulnerability now but they don't at the time. Now many programmers start including this button with their program. One day someone may discover this and click the button and instantly get admin access. This would be considered a 0-day because no one else knew about it.

Months later when this button is discovered, it will eventually be patched. If programmers still include this button in their programs, then it is not a 0-day because it doesn't meet the criteria for 0-day exploit anymore because it is known.

In questions example, Apache has a known flaw, so this would not be a 0-day exploit. It is known to the public.

It is already known that SQL vulnerabilities exists from bad coding and without proper escaping or by not using parameterized queries. However, if you found a SQL vulnerability that allowed execution of unwanted statements that has not been addressed before, then this would be a finding.

share|improve this answer
    
So, a working definition would be that it needs to be the kind of thing which a reasonable person might guess an exploit-finding tool as they currently exist likely wouldn't find (with the possible exception of a fuzzer). This makes sense... And while it may seem like a stupid thing to ask, generally I've found it's better to look stupid anonymously online now, than when someone asks me for a concrete definition, later. –  root Mar 28 '13 at 5:43
2  
"A 0-day exploit is a vulnerability not known to the public" New Java or Adobe Reader exploits are always called 0-days even when they're publicized immediately. You're saying this use of the term 0-day is incorrect? –  Luc Mar 28 '13 at 9:09
    
Isn't this a grey area - we know buffer overflows exist but that doesn't discount every new buffer overflow because "oh, we know about buffer overflows already". So therefore should we be discounting a new SQL vulnerability in Jon's Cat Blog? It seems odd to refer to that as an 0day, however. –  Andy Smith Mar 28 '13 at 13:52
    
If I found a new SQLi in a popular framework such as WordPress, I would refer to that as a 0day. But for some reason an SQLi in a one-off platform (such as a server-side API application) would not count in my mind, odd. –  lynks Mar 28 '13 at 14:54
1  
@ponsfonze Who says it already has a patch upon releasing it to he public? Hmm actually I think that might be a good way to define when people use the term zero-day: when there is no patch yet (regardless of whether the leak is public). –  Luc Mar 28 '13 at 15:16

No it doesn't count.

A zero-day vulnerability is a previously unknown vulnerability. What you are describing is merely bad patch management if the vulnerability stems from a known exploit for the Apache service that has not been fixed.

share|improve this answer
    
Okay. Say there was an error in GCC which would generate vulnerable code, and someone compiled an application of theirs with that version of GCC and released it. Subsequently, the flaw in GCC is found and patched. Obviously, the flaw in GCC was a 0day, but GCC was only an optional component of the application released (they could have gone with a different component). Would the error in the compiled product, if/when found, still count as a 0day, after the GCC flaw was known? If not, what's different enough about the situation? –  root Mar 28 '13 at 3:24
    
Print format vulnerabilities are a known exploit. If I find something that has a print format vulnerability, does it cease to count because those are known to be exploitable, and the person did a bad job of patching their code? –  root Mar 28 '13 at 3:27
1  
Weren't all vulnerabilities "previously unknown" at some point? Aren't they all zero-days then? –  Luc Mar 28 '13 at 9:07
1  
@Luc At the point where they were unknown, yes. That's the whole definition of zero-day. –  Terry Chia Mar 28 '13 at 10:48

A zero-day (or zero-hour or day zero) attack or threat is an attack that exploits a previously unknown vulnerability in a computer application, meaning that the attack occurs on "day zero" of awareness of the vulnerability.[1] This means that the developers have had zero days to address and patch the vulnerability. Zero-day exploits (actual software that uses a security hole to carry out an attack) are used or shared by attackers before the developer of the target software knows about the vulnerability.

https://en.wikipedia.org/wiki/Zero-day_attack

share|improve this answer

A zero day is finding a new method of exploiting something, not finding a new place to exploit something using a known method.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.