Tag Info

Hot answers tagged

25

I think this is a "trend effect" which is also the drive under everything about fashion (in the "clothing" sense). Please allow the local Frenchman to talk about fashion. Fashion is a deeply self-contradictory social behaviour. People who follow fashions seek both: to gain acceptance in a given local group by displaying adherence to perceived agreed upon ...


8

It's because the vulnerability was actually first discovered in 2010 (even if it wasn't reported as a security issue back then, just as a bug), and rediscovered again in 2014 by Ted Unangst after heartbleed became the straw that broke the camel back, and this time correctly identified as an issue with security implications. Original bug report : ...


7

From the CVE FAQ: An information security vulnerability is a mistake in software that can be directly used by a hacker to gain access to a system or network. See the Terminology page for a complete explanation of how this term is used on the CVE Web site.   The intention of CVE is to be comprehensive with respect to all publicly known ...


6

Excellent infographic! Unless someone were to actually sit-down and read through the various CVE's and understand them in-and-out, it would be difficult to provide any sort of substantial answer. That said, I'm willing to conjecture wildly here. Browser creep -- with three main-stream browsers (IE, Firefox, and Chrome) the plugins have to be developed ...


5

Go to CVE Details' Product or Vendor pages. There is "Vulnerability Feeds & Widgets" link there. It allows you to subscribe to CVEs about selected vendor/product.


5

There are multiple ways to obtain a CVE. One could contact one of the CVE Numbering Authorities (CNA), an emergency response team (think CERT) or the CVE project. If the vendor of a product is listed as a CNA you must contact the vendor to obtain a CVE. Sufficient information must be provided to allow the CVE assigner to take a decision (provide the CVE, ...


4

Let's break this down, first of all have a look at the CVSS score: (AV:L/AC:M/Au:N/C:C/I:C/A:C) So: Access Vector: Local Access complexity: Medium Authentication: None Confidentiality: Complete Integrity: Complete Availability: Complete The vulnerability can result in privilege escalation, meaning a user with few privileges, might gain access to the ...


4

If you are looking for the vulnerability reports and databases, I've already answered this in this stackoverflow answer. Copy-pasting again for easy reference: Common Vulnerabilities and Exposures project (CVE) http://seclists.org/fulldisclosure http://packetstormsecurity.org/ http://www.securityfocus.com/bid/ (BugTraq) http://www.exploit-db.com/ ...


4

The most reliable source, is probably Metasploit's vulnerability & exploits DB - But some alternate sources do exist: You can use Exploit-DB search to search by CVE exploits by "metasploit" e.g.: ...


3

NVD covers a lot of vulnerabilities. Aside from those you also have: Security Focus (bugtraq) OSVDB They are often linked back to NVD CVE. Another interesting project to follow is vFeed which provides cross linking between vendors and CVE vulnerabilities. Note that this covers disclosed vulnerabilities. There are still a lot of vulnerabilities which ...


3

The National Vulnerability Database offer searching the vulnerability database using the CVE number. The details include patch information as well as resource links for the available patch on the vendor's website (if patch is available). When you search a vulnerability, the details include a section called References to Advisories, Solutions, and Tools. In ...


3

I'm not aware of any good out-of-the-box services, but I usually cross-reference with sites like: SecurityFocus: It usually references CVE. Patch status filed under "Solution". PacketStormSecurity: Allows fulltext search (can search for CVE ID). Patch status filed under "Mitigation". OSVDB: Has an option to search with CVE ID. Patch status filed under ...


3

My understanding is that issues that affect individual websites (say, an XSS on facebook) are not eligible for a CVE, though web applications are. So, an issue that only affects Facebook isn't, but an issue in a web application like WordPress would be. The application doesn't have to be popular - I once requested a CVE for an application that probably has ...


2

If you want to keep yourself about the latest discovered security vulnerabilities, BugTraq would probably be your best bet. If you want to keep track of security breaches of organisations, the news would be your best bet. There is no consolidated resources that provide immediate feedback about such matters that I know of.


2

secunia makes a commercial product that does exactly what you want. "The Secunia VIM lets you create specific vulnerability management reports for different product categories across your entire IT infrastructure by filtering criteria. So you only get vulnerability alerts and intelligence relevant to your specific needs."


2

Debian provides a feed for its security advisories: http://www.debian.org/security/dsa. There is a link to each advisory which lists the CVE addressed by that fix. The debian-security-announce@debian.org mailing list provides the same information. These advisories have been declared CVE-compatible. The email and RSS feeds are the most timely way to retrieve ...


2

PTS/QA You go to the package's QA page. For this, you either use the source package name (here "bind9"): http://packages.qa.debian.org/bind9 Or you use the binary package name (e.g. "bind9-host"): http://packages.debian.org/bind9-host If you used the binary one, click on the package in a distro (e.g. oldstable)¹, then on “Developer Information (PTS)” ...


1

Most likely they would like to release a patch before making a public CVE. If they released a public CVE before they patched it would only hurt themselves, as the current version would be open to attack. Once they release a patch and are able to notify their customers, then I would expect that they would release a CVE to get the general public caught up.


1

cpe-lang shows if are other dependencies for the vulnerable product. If you look over the NVD CVE's you will see some products are vulnerable only on some specific platforms. For example <cpe-lang:logical-test negate="false" operator="AND"> <cpe-lang:logical-test negate="false" operator="OR"> <cpe-lang:fact-ref ...


1

You can request a CVE number without the details being published. The timeline I have previously followed is: Notify vendor Request CVE number, while waiting for vendor response Publish advisory, once issue is fixed or a certain amount of time has passed I consider the CVE guys reasonably trustworthy, and I will disclose high-level details of the ...


1

If you apply for a CVE ID and are granted one, then the vulnerability will become public knowledge. It is recommended that you first contact the software developer and wait 30 days for their response. Depending on the severity of the vulnerability, they may ask that you do not make the vulnerability known to the public until they have had time to patch. ...


1

Yes, CVE-2014-0196 can be used for privilege escalation, because it allows overwriting buffers in the kernel outside the one allocated to your pty. This means that a non-privileged user could use it to become root. It's not limited to the friends that you've allowed access, either. If an attacker were able to compromise a service running on your system ...


1

The choice between projects with big bounty offerings and small projects with no budget at all is getting less and less important. Projects like Google's Patch Reward program mean that even bugs in GCC can earn you money if you write a patch to fix the bug. You can earn recognition for projects without bug reward programs. As an example, a couple of ...


1

The answer is no, this doesn't mean you are immune to this attack. If an attacker is unable to compile the exploit on your system, he can as well compile it somewhere else and then upload and run it on your server, providing he has an access to your server of course. Generally speaking, you should not rely on denying access to gcc or any other utility to ...


1

I would go with the CVSS calculator from the NIST which you can find here http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2 If the vulnerability can be exploited over a non-adjacent network, and the Access Complexity is Low, and the attacker needs to authenticate multiple times you have AN:N, AC:L, Au:M No impact on the Confidentiality and ...


1

This functionality is mainly what can be expected by most vulnerability scanners. For one but Nexpose and Nessus automatically say if a Metasploit exploit is available and what name it is. There is a plugin available here on github, which could do what you want given some modification in regards to openVAS integration. This plugin does auto-exploitation ...


1

The nonexistence of a CVE is a horrible justification for not implementing a security measure. The whole point of this game to stay ahead of your attackers, and if the hypothetical attackers are only using widely-disseminated and public vulns they really aren't very good at what they do. Text relocations are "bad" because they are a special case of ...


1

There are two major points to make. The first is that a major strength of SELinux policy is to prevent exploitation of unknown vulnerabilities. Given that they are unknown, a CVE will not exist. The second is that permitting text relocation also permits an exploit to write and execute whatever code it would like to execute, or allows it to modify existing ...



Only top voted, non community-wiki answers of a minimum length are eligible