Tag Info

Hot answers tagged

26

I think this is a "trend effect" which is also the drive under everything about fashion (in the "clothing" sense). Please allow the local Frenchman to talk about fashion. Fashion is a deeply self-contradictory social behaviour. People who follow fashions seek both: to gain acceptance in a given local group by displaying adherence to perceived agreed upon ...


10

Why don't some vulnerabilities have CVE numbers? It's usually either that the entity who found the vulnerability didn't care to request one, or that, for some reason, a CVE Numbering Authority (CNA) or MITRE themselves decided not to include the vulnerability in the system. Why are CVE entries sometimes empty? The CVE number assignment procedure ...


8

It's because the vulnerability was actually first discovered in 2010 (even if it wasn't reported as a security issue back then, just as a bug), and rediscovered again in 2014 by Ted Unangst after heartbleed became the straw that broke the camel back, and this time correctly identified as an issue with security implications. Original bug report : ...


7

From the CVE FAQ: An information security vulnerability is a mistake in software that can be directly used by a hacker to gain access to a system or network. See the Terminology page for a complete explanation of how this term is used on the CVE Web site.   The intention of CVE is to be comprehensive with respect to all publicly known ...


6

Excellent infographic! Unless someone were to actually sit-down and read through the various CVE's and understand them in-and-out, it would be difficult to provide any sort of substantial answer. That said, I'm willing to conjecture wildly here. Browser creep -- with three main-stream browsers (IE, Firefox, and Chrome) the plugins have to be developed ...


6

Go to CVE Details' Product or Vendor pages. There is "Vulnerability Feeds & Widgets" link there. It allows you to subscribe to CVEs about selected vendor/product.


5

Let's break this down, first of all have a look at the CVSS score: (AV:L/AC:M/Au:N/C:C/I:C/A:C) So: Access Vector: Local Access complexity: Medium Authentication: None Confidentiality: Complete Integrity: Complete Availability: Complete The vulnerability can result in privilege escalation, meaning a user with few privileges, might gain access to the ...


5

The most reliable source, is probably Metasploit's vulnerability & exploits DB - But some alternate sources do exist: You can use Exploit-DB search to search by CVE exploits by "metasploit" e.g.: ...


5

There are multiple ways to obtain a CVE. One could contact one of the CVE Numbering Authorities (CNA), an emergency response team (think CERT) or the CVE project. If the vendor of a product is listed as a CNA you must contact the vendor to obtain a CVE. Sufficient information must be provided to allow the CVE assigner to take a decision (provide the CVE, ...


4

If you are looking for the vulnerability reports and databases, I've already answered this in this stackoverflow answer. Copy-pasting again for easy reference: Common Vulnerabilities and Exposures project (CVE) http://seclists.org/fulldisclosure http://packetstormsecurity.org/ http://www.securityfocus.com/bid/ (BugTraq) http://www.exploit-db.com/ ...


4

CVE is only the vulnerability report, it doesn't necessarily mean that it is exploitable. Also, we are very fortunate that even if exploitable, not all vulnerabilities have publicly available exploits, and especially ones that are available within the Metasploit framework. Otherwise we would have lots of script-kiddies running around armed and dangerous! On ...


3

NVD covers a lot of vulnerabilities. Aside from those you also have: Security Focus (bugtraq) OSVDB They are often linked back to NVD CVE. Another interesting project to follow is vFeed which provides cross linking between vendors and CVE vulnerabilities. Note that this covers disclosed vulnerabilities. There are still a lot of vulnerabilities which ...


3

The National Vulnerability Database offer searching the vulnerability database using the CVE number. The details include patch information as well as resource links for the available patch on the vendor's website (if patch is available). When you search a vulnerability, the details include a section called References to Advisories, Solutions, and Tools. In ...


3

I'm not aware of any good out-of-the-box services, but I usually cross-reference with sites like: SecurityFocus: It usually references CVE. Patch status filed under "Solution". PacketStormSecurity: Allows fulltext search (can search for CVE ID). Patch status filed under "Mitigation". OSVDB: Has an option to search with CVE ID. Patch status filed under ...


3

My understanding is that issues that affect individual websites (say, an XSS on facebook) are not eligible for a CVE, though web applications are. So, an issue that only affects Facebook isn't, but an issue in a web application like WordPress would be. The application doesn't have to be popular - I once requested a CVE for an application that probably has ...


3

cvedetails.com provides CVE feeds which can be filtered by product. Just access them from the product page. PHP feed Apache feed


2

If you want to keep yourself about the latest discovered security vulnerabilities, BugTraq would probably be your best bet. If you want to keep track of security breaches of organisations, the news would be your best bet. There is no consolidated resources that provide immediate feedback about such matters that I know of.


2

secunia makes a commercial product that does exactly what you want. "The Secunia VIM lets you create specific vulnerability management reports for different product categories across your entire IT infrastructure by filtering criteria. So you only get vulnerability alerts and intelligence relevant to your specific needs."


2

Debian provides a feed for its security advisories: http://www.debian.org/security/dsa. There is a link to each advisory which lists the CVE addressed by that fix. The debian-security-announce@debian.org mailing list provides the same information. These advisories have been declared CVE-compatible. The email and RSS feeds are the most timely way to retrieve ...


2

The choice between projects with big bounty offerings and small projects with no budget at all is getting less and less important. Projects like Google's Patch Reward program mean that even bugs in GCC can earn you money if you write a patch to fix the bug. You can earn recognition for projects without bug reward programs. As an example, a couple of ...


2

PTS/QA You go to the package's QA page. For this, you either use the source package name (here "bind9"): http://packages.qa.debian.org/bind9 Or you use the binary package name (e.g. "bind9-host"): http://packages.debian.org/bind9-host If you used the binary one, click on the package in a distro (e.g. oldstable)¹, then on “Developer Information (PTS)” ...


2

Yes, CVE-2014-0196 can be used for privilege escalation, because it allows overwriting buffers in the kernel outside the one allocated to your pty. This means that a non-privileged user could use it to become root. It's not limited to the friends that you've allowed access, either. If an attacker were able to compromise a service running on your system ...


2

CVE Details allows you to create a customized RSS feed with certain CVSS scores. : http://www.cvedetails.com/vulnerability-feeds-form.php However, I'm not sure if there's a way to filter out only Windows & Red Hat OS vulns.. but perhaps someone has an idea?


2

One difference is the ease to find a reliable and automated tool to check for compliance. I believe Nessus has templates available for most of the ones you have listed, but some are dated. In any case, I'd choose one that makes it as easy as possible for you to check and stay in compliance.


2

Here are some important considerations: What is the reason that you're hardening against a given benchmark or guideline? Are you going to be audited? Is there a preferred route or route the your auditors are more familiar with? What tools will you use for self auditing? Do those tools have polices or plugins to audit your system against a given ...


2

In general, DISA STIGs are more stringent than CIS Benchmarks. Keep in mind that with STIGs, what exact configurations are required depends on the classification of the system based on Mission Assurance Catagory (I-III) and Confidentiality Level (Public-Classified), giving you 9 different possible combinations of config requirements. CIS usually have a Level ...


2

So it appears that the Red Hat errata and CentOS errata are the same numbers. This is Red Hat's format: RHSA-YYYY-#### And this is CentOS' format: CESA-YYYY:#### Where #### is the same number for both. So, to solve your example question, here's what I did: I went on the RedHat site and searched for the CVE number. This led me to the CVE page ...


2

An attack vector is a path or means by which an attacker can gain access to a computer or network server in order to deliver a payload or malicious outcome. When it's not specified, it simply means that probably there is a way, but no-one has found one or the vendor does not want the vector to be disclosed yet.


2

In the versions of nginx listed, when handling mp4 files, an attacker could send a malicious mp4 file. Because of a potential buffer overflow situation, the contents of the mp4 file will be written to a part of memory that nginx doesn't expect to be changed. This could cause nginx to crash (denial of service) or, if the attacker can structure the mp4 file ...


1

mod_fcgi itself is not vulnerable: it talks to Apache through interprocess communication rather than the environment variables of traditional CGI. Any CGI scripts run through mod_fcgi can still be vulnerable if 1) they can be coerced into setting environment variables and 2) invoke bash (say, through a system() call or backtick interpolation).



Only top voted, non community-wiki answers of a minimum length are eligible