Hot answers tagged

26

I think this is a "trend effect" which is also the drive under everything about fashion (in the "clothing" sense). Please allow the local Frenchman to talk about fashion. Fashion is a deeply self-contradictory social behaviour. People who follow fashions seek both: to gain acceptance in a given local group by displaying adherence to perceived agreed upon ...


15

Given you have referenced Github, I will assume this related to some type of As an open source project, a note to oss-sec is a good idea. This will bring it to the attention of most upstream distributors. You do not need to subscribe to post to oss-sec, but you should note carefully the etiquette/content guidelines in the link above. A rummage through the ...


13

This is not a privilege escalation where code gets "only" executed as a higher privileged user. This issue is about execution of code inside the Linux kernel, i.e. the kernel which gets shared between all docker instances and the OS containing the docker instances. This is the highest privilege one could get and at this level one can bypass any kind of ...


10

Why don't some vulnerabilities have CVE numbers? It's usually either that the entity who found the vulnerability didn't care to request one, or that, for some reason, a CVE Numbering Authority (CNA) or MITRE themselves decided not to include the vulnerability in the system. Why are CVE entries sometimes empty? The CVE number assignment procedure ...


9

It's because the vulnerability was actually first discovered in 2010 (even if it wasn't reported as a security issue back then, just as a bug), and rediscovered again in 2014 by Ted Unangst after heartbleed became the straw that broke the camel back, and this time correctly identified as an issue with security implications. Original bug report : https://rt....


8

From the CVE FAQ: An information security vulnerability is a mistake in software that can be directly used by a hacker to gain access to a system or network. See the Terminology page for a complete explanation of how this term is used on the CVE Web site.   The intention of CVE is to be comprehensive with respect to all publicly known ...


8

Go to CVE Details' Product or Vendor pages. There is "Vulnerability Feeds & Widgets" link there. It allows you to subscribe to CVEs about selected vendor/product.


7

For the 2010-3749 issue, presuming you're looking at this exploit it doesn't really look like a canned exploit, more like an explanation of the issue. It would require for the application in question to make use of the vulnerable function for it to be exploitable. Indeed, having a quick look through some of the issues that you've linked they look to be PHP ...


7

A buffer overflow (of the "write" kind) gives any advantage to an attacker only if the attacker can arrange for the overflow to spill over other bytes that are used for something else. At any time, the process runs in an address space, most of which being unallocated. If the buffer which is overflown is at the end of the address space, or is followed only by ...


6

Excellent infographic! Unless someone were to actually sit-down and read through the various CVE's and understand them in-and-out, it would be difficult to provide any sort of substantial answer. That said, I'm willing to conjecture wildly here. Browser creep -- with three main-stream browsers (IE, Firefox, and Chrome) the plugins have to be developed ...


6

There are multiple ways to obtain a CVE. One could contact one of the CVE Numbering Authorities (CNA), an emergency response team (think CERT) or the CVE project. If the vendor of a product is listed as a CNA you must contact the vendor to obtain a CVE. Sufficient information must be provided to allow the CVE assigner to take a decision (provide the CVE, ...


5

If you are looking for the vulnerability reports and databases, I've already answered this in this stackoverflow answer. Copy-pasting again for easy reference: Common Vulnerabilities and Exposures project (CVE) http://seclists.org/fulldisclosure http://packetstormsecurity.org/ http://www.securityfocus.com/bid/ (BugTraq) http://www.exploit-db.com/ ...


5

The most reliable source, is probably Metasploit's vulnerability & exploits DB - But some alternate sources do exist: You can use Exploit-DB search to search by CVE exploits by "metasploit" e.g.: http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description=&filter_exploit_text=&filter_author=metasploit&...


5

Let's break this down, first of all have a look at the CVSS score: (AV:L/AC:M/Au:N/C:C/I:C/A:C) So: Access Vector: Local Access complexity: Medium Authentication: None Confidentiality: Complete Integrity: Complete Availability: Complete The vulnerability can result in privilege escalation, meaning a user with few privileges, might gain access to the ...


5

In general, DISA STIGs are more stringent than CIS Benchmarks. Keep in mind that with STIGs, what exact configurations are required depends on the classification of the system based on Mission Assurance Catagory (I-III) and Confidentiality Level (Public-Classified), giving you 9 different possible combinations of config requirements. CIS usually have a Level ...


4

NVD covers a lot of vulnerabilities. Aside from those you also have: Security Focus (bugtraq) OSVDB They are often linked back to NVD CVE. Another interesting project to follow is vFeed which provides cross linking between vendors and CVE vulnerabilities. Note that this covers disclosed vulnerabilities. There are still a lot of vulnerabilities which ...


4

I'm not aware of any good out-of-the-box services, but I usually cross-reference with sites like: SecurityFocus: It usually references CVE. Patch status filed under "Solution". PacketStormSecurity: Allows fulltext search (can search for CVE ID). Patch status filed under "Mitigation". OSVDB: Has an option to search with CVE ID. Patch status filed under "...


4

CVE Details allows you to create a customized RSS feed with certain CVSS scores. : http://www.cvedetails.com/vulnerability-feeds-form.php However, I'm not sure if there's a way to filter out only Windows & Red Hat OS vulns.. but perhaps someone has an idea?


4

CVE is only the vulnerability report, it doesn't necessarily mean that it is exploitable. Also, we are very fortunate that even if exploitable, not all vulnerabilities have publicly available exploits, and especially ones that are available within the Metasploit framework. Otherwise we would have lots of script-kiddies running around armed and dangerous! On ...


4

A CVE is a vulnerability description, ie. a document stating that some security property has been found to be broken. As explained in Ohnana's comment, a CVE might indeed state that to be exploitable some other security properties not part of this CVE should also be broken (typically CVE requiring a specific access from the attacker, whether it is local, ...


4

Most developers I know who are using OS X are using Homebrew for a variety of reasons; in addition to providing easy installation of tools not available from Apple, the updated versions of Apple-provided tools provide bugfixes and security fixes. And yes, Homebrew is currently distributing git 2.7.4.


4

[Note: see the answer by @tim, which is a more thorough anwser than my quick google.] MITRE has official documentation that answers your question right on cve.mitre.org, specifically have a look at https://cve.mitre.org/cve/identifiers/index.html which gives a thorough description of CVE Identifiers, how they are created, and how to request one. The home ...


4

One of the methods you can use to create a baseline would be to go to sites like PacketStorm find say the last 50 vulnerabilities/exploits disclosed, then find out whether or not they have CVEs issued on Mitre. A baseline will give you just that, a baseline average. There are a few things to take into considerations: Not all exploits/vulnerabilities are ...


3

The National Vulnerability Database offer searching the vulnerability database using the CVE number. The details include patch information as well as resource links for the available patch on the vendor's website (if patch is available). When you search a vulnerability, the details include a section called References to Advisories, Solutions, and Tools. In ...


3

If you want to keep yourself about the latest discovered security vulnerabilities, BugTraq would probably be your best bet. If you want to keep track of security breaches of organisations, the news would be your best bet. There is no consolidated resources that provide immediate feedback about such matters that I know of.


3

My understanding is that issues that affect individual websites (say, an XSS on facebook) are not eligible for a CVE, though web applications are. So, an issue that only affects Facebook isn't, but an issue in a web application like WordPress would be. The application doesn't have to be popular - I once requested a CVE for an application that probably has ...


3

cvedetails.com provides CVE feeds which can be filtered by product. Just access them from the product page. PHP feed Apache feed


3

Here are some important considerations: What is the reason that you're hardening against a given benchmark or guideline? Are you going to be audited? Is there a preferred route or route the your auditors are more familiar with? What tools will you use for self auditing? Do those tools have polices or plugins to audit your system against a given ...


3

So it appears that the Red Hat errata and CentOS errata are the same numbers. This is Red Hat's format: RHSA-YYYY-#### And this is CentOS' format: CESA-YYYY:#### Where #### is the same number for both. So, to solve your example question, here's what I did: I went on the RedHat site and searched for the CVE number. This led me to the CVE page ...


3

You could try the exploit directly on any given host and determine your own level-of risk. My initial thought is that even on Android, many kernels have SMEP/SMAP enabled, thus preventing the canned exploit code above. One would need to rewrite the exploit with ROP or use a similar SMEP/SMAP bypass technique. (Update 2016/Feb/06 -- Collin R. Mulliner ...



Only top voted, non community-wiki answers of a minimum length are eligible