Hot answers tagged

26

I think this is a "trend effect" which is also the drive under everything about fashion (in the "clothing" sense). Please allow the local Frenchman to talk about fashion. Fashion is a deeply self-contradictory social behaviour. People who follow fashions seek both: to gain acceptance in a given local group by displaying adherence to perceived agreed upon ...


14

Given you have referenced Github, I will assume this related to some type of As an open source project, a note to oss-sec is a good idea. This will bring it to the attention of most upstream distributors. You do not need to subscribe to post to oss-sec, but you should note carefully the etiquette/content guidelines in the link above. A rummage through the ...


10

Why don't some vulnerabilities have CVE numbers? It's usually either that the entity who found the vulnerability didn't care to request one, or that, for some reason, a CVE Numbering Authority (CNA) or MITRE themselves decided not to include the vulnerability in the system. Why are CVE entries sometimes empty? The CVE number assignment procedure ...


10

This is not a privilege escalation where code gets "only" executed as a higher privileged user. This issue is about execution of code inside the Linux kernel, i.e. the kernel which gets shared between all docker instances and the OS containing the docker instances. This is the highest privilege one could get and at this level one can bypass any kind of ...


8

Go to CVE Details' Product or Vendor pages. There is "Vulnerability Feeds & Widgets" link there. It allows you to subscribe to CVEs about selected vendor/product.


8

From the CVE FAQ: An information security vulnerability is a mistake in software that can be directly used by a hacker to gain access to a system or network. See the Terminology page for a complete explanation of how this term is used on the CVE Web site.   The intention of CVE is to be comprehensive with respect to all publicly known ...


8

It's because the vulnerability was actually first discovered in 2010 (even if it wasn't reported as a security issue back then, just as a bug), and rediscovered again in 2014 by Ted Unangst after heartbleed became the straw that broke the camel back, and this time correctly identified as an issue with security implications. Original bug report : ...


6

Excellent infographic! Unless someone were to actually sit-down and read through the various CVE's and understand them in-and-out, it would be difficult to provide any sort of substantial answer. That said, I'm willing to conjecture wildly here. Browser creep -- with three main-stream browsers (IE, Firefox, and Chrome) the plugins have to be developed ...


5

Let's break this down, first of all have a look at the CVSS score: (AV:L/AC:M/Au:N/C:C/I:C/A:C) So: Access Vector: Local Access complexity: Medium Authentication: None Confidentiality: Complete Integrity: Complete Availability: Complete The vulnerability can result in privilege escalation, meaning a user with few privileges, might gain access to the ...


5

There are multiple ways to obtain a CVE. One could contact one of the CVE Numbering Authorities (CNA), an emergency response team (think CERT) or the CVE project. If the vendor of a product is listed as a CNA you must contact the vendor to obtain a CVE. Sufficient information must be provided to allow the CVE assigner to take a decision (provide the CVE, ...


5

If you are looking for the vulnerability reports and databases, I've already answered this in this stackoverflow answer. Copy-pasting again for easy reference: Common Vulnerabilities and Exposures project (CVE) http://seclists.org/fulldisclosure http://packetstormsecurity.org/ http://www.securityfocus.com/bid/ (BugTraq) http://www.exploit-db.com/ ...


5

The most reliable source, is probably Metasploit's vulnerability & exploits DB - But some alternate sources do exist: You can use Exploit-DB search to search by CVE exploits by "metasploit" e.g.: ...


4

CVE Details allows you to create a customized RSS feed with certain CVSS scores. : http://www.cvedetails.com/vulnerability-feeds-form.php However, I'm not sure if there's a way to filter out only Windows & Red Hat OS vulns.. but perhaps someone has an idea?


4

In general, DISA STIGs are more stringent than CIS Benchmarks. Keep in mind that with STIGs, what exact configurations are required depends on the classification of the system based on Mission Assurance Catagory (I-III) and Confidentiality Level (Public-Classified), giving you 9 different possible combinations of config requirements. CIS usually have a Level ...


4

CVE is only the vulnerability report, it doesn't necessarily mean that it is exploitable. Also, we are very fortunate that even if exploitable, not all vulnerabilities have publicly available exploits, and especially ones that are available within the Metasploit framework. Otherwise we would have lots of script-kiddies running around armed and dangerous! On ...


4

A CVE is a vulnerability description, ie. a document stating that some security property has been found to be broken. As explained in Ohnana's comment, a CVE might indeed state that to be exploitable some other security properties not part of this CVE should also be broken (typically CVE requiring a specific access from the attacker, whether it is local, ...


3

NVD covers a lot of vulnerabilities. Aside from those you also have: Security Focus (bugtraq) OSVDB They are often linked back to NVD CVE. Another interesting project to follow is vFeed which provides cross linking between vendors and CVE vulnerabilities. Note that this covers disclosed vulnerabilities. There are still a lot of vulnerabilities which ...


3

The National Vulnerability Database offer searching the vulnerability database using the CVE number. The details include patch information as well as resource links for the available patch on the vendor's website (if patch is available). When you search a vulnerability, the details include a section called References to Advisories, Solutions, and Tools. In ...


3

I'm not aware of any good out-of-the-box services, but I usually cross-reference with sites like: SecurityFocus: It usually references CVE. Patch status filed under "Solution". PacketStormSecurity: Allows fulltext search (can search for CVE ID). Patch status filed under "Mitigation". OSVDB: Has an option to search with CVE ID. Patch status filed under ...


3

If you want to keep yourself about the latest discovered security vulnerabilities, BugTraq would probably be your best bet. If you want to keep track of security breaches of organisations, the news would be your best bet. There is no consolidated resources that provide immediate feedback about such matters that I know of.


3

My understanding is that issues that affect individual websites (say, an XSS on facebook) are not eligible for a CVE, though web applications are. So, an issue that only affects Facebook isn't, but an issue in a web application like WordPress would be. The application doesn't have to be popular - I once requested a CVE for an application that probably has ...


3

cvedetails.com provides CVE feeds which can be filtered by product. Just access them from the product page. PHP feed Apache feed


3

Here are some important considerations: What is the reason that you're hardening against a given benchmark or guideline? Are you going to be audited? Is there a preferred route or route the your auditors are more familiar with? What tools will you use for self auditing? Do those tools have polices or plugins to audit your system against a given ...


3

You could try the exploit directly on any given host and determine your own level-of risk. My initial thought is that even on Android, many kernels have SMEP/SMAP enabled, thus preventing the canned exploit code above. One would need to rewrite the exploit with ROP or use a similar SMEP/SMAP bypass technique. (Update 2016/Feb/06 -- Collin R. Mulliner ...


3

The industry will not fall apart, because such an outcome would mean that the industry at large minds CVE numbers and acknowledges their existence; the day this will become true will be a glorious day indeed.


3

The solution for running out of space in the CVE numbering scheme was to change to a "new format" that allows for additional digits in the last part of the CVE ID as needed. A request for input into the new format selection was put out in January 2013, with a decision announced in July of the same year, and the policy went into effect at the start of 2014. A ...


3

This is good question. I investigated this issue two weeks ago as it was out. This bug appeared for the first time in openssh-6.8 in refactoring commit. Basically the issue is that there was replaced function which called exit() with function only returning error value. if (state->packlen < 1 + 4 || state->packlen > PACKET_MAX_SIZE) { #ifdef ...


2

This may seem like a lame answer to you but my rule of thumb is pretty simple and cheaper than trying to validate third party JS libraries Only use well-known, actively maintained, patched libraries like Jquery. Look at the list of libraries available on Google and that's a great hint you are dealing with reliable code If you are rolling your own, or on ...


2

secunia makes a commercial product that does exactly what you want. "The Secunia VIM lets you create specific vulnerability management reports for different product categories across your entire IT infrastructure by filtering criteria. So you only get vulnerability alerts and intelligence relevant to your specific needs."


2

Debian provides a feed for its security advisories: http://www.debian.org/security/dsa. There is a link to each advisory which lists the CVE addressed by that fix. The debian-security-announce@debian.org mailing list provides the same information. These advisories have been declared CVE-compatible. The email and RSS feeds are the most timely way to retrieve ...



Only top voted, non community-wiki answers of a minimum length are eligible