Tag Info

Hot answers tagged

26

I think this is a "trend effect" which is also the drive under everything about fashion (in the "clothing" sense). Please allow the local Frenchman to talk about fashion. Fashion is a deeply self-contradictory social behaviour. People who follow fashions seek both: to gain acceptance in a given local group by displaying adherence to perceived agreed upon ...


10

Why don't some vulnerabilities have CVE numbers? It's usually either that the entity who found the vulnerability didn't care to request one, or that, for some reason, a CVE Numbering Authority (CNA) or MITRE themselves decided not to include the vulnerability in the system. Why are CVE entries sometimes empty? The CVE number assignment procedure ...


8

It's because the vulnerability was actually first discovered in 2010 (even if it wasn't reported as a security issue back then, just as a bug), and rediscovered again in 2014 by Ted Unangst after heartbleed became the straw that broke the camel back, and this time correctly identified as an issue with security implications. Original bug report : ...


7

From the CVE FAQ: An information security vulnerability is a mistake in software that can be directly used by a hacker to gain access to a system or network. See the Terminology page for a complete explanation of how this term is used on the CVE Web site.   The intention of CVE is to be comprehensive with respect to all publicly known ...


6

Excellent infographic! Unless someone were to actually sit-down and read through the various CVE's and understand them in-and-out, it would be difficult to provide any sort of substantial answer. That said, I'm willing to conjecture wildly here. Browser creep -- with three main-stream browsers (IE, Firefox, and Chrome) the plugins have to be developed ...


5

Let's break this down, first of all have a look at the CVSS score: (AV:L/AC:M/Au:N/C:C/I:C/A:C) So: Access Vector: Local Access complexity: Medium Authentication: None Confidentiality: Complete Integrity: Complete Availability: Complete The vulnerability can result in privilege escalation, meaning a user with few privileges, might gain access to the ...


5

Go to CVE Details' Product or Vendor pages. There is "Vulnerability Feeds & Widgets" link there. It allows you to subscribe to CVEs about selected vendor/product.


5

There are multiple ways to obtain a CVE. One could contact one of the CVE Numbering Authorities (CNA), an emergency response team (think CERT) or the CVE project. If the vendor of a product is listed as a CNA you must contact the vendor to obtain a CVE. Sufficient information must be provided to allow the CVE assigner to take a decision (provide the CVE, ...


4

If you are looking for the vulnerability reports and databases, I've already answered this in this stackoverflow answer. Copy-pasting again for easy reference: Common Vulnerabilities and Exposures project (CVE) http://seclists.org/fulldisclosure http://packetstormsecurity.org/ http://www.securityfocus.com/bid/ (BugTraq) http://www.exploit-db.com/ ...


4

The most reliable source, is probably Metasploit's vulnerability & exploits DB - But some alternate sources do exist: You can use Exploit-DB search to search by CVE exploits by "metasploit" e.g.: ...


3

NVD covers a lot of vulnerabilities. Aside from those you also have: Security Focus (bugtraq) OSVDB They are often linked back to NVD CVE. Another interesting project to follow is vFeed which provides cross linking between vendors and CVE vulnerabilities. Note that this covers disclosed vulnerabilities. There are still a lot of vulnerabilities which ...


3

The National Vulnerability Database offer searching the vulnerability database using the CVE number. The details include patch information as well as resource links for the available patch on the vendor's website (if patch is available). When you search a vulnerability, the details include a section called References to Advisories, Solutions, and Tools. In ...


3

I'm not aware of any good out-of-the-box services, but I usually cross-reference with sites like: SecurityFocus: It usually references CVE. Patch status filed under "Solution". PacketStormSecurity: Allows fulltext search (can search for CVE ID). Patch status filed under "Mitigation". OSVDB: Has an option to search with CVE ID. Patch status filed under ...


3

My understanding is that issues that affect individual websites (say, an XSS on facebook) are not eligible for a CVE, though web applications are. So, an issue that only affects Facebook isn't, but an issue in a web application like WordPress would be. The application doesn't have to be popular - I once requested a CVE for an application that probably has ...


3

cvedetails.com provides CVE feeds which can be filtered by product. Just access them from the product page. PHP feed Apache feed


3

CVE is only the vulnerability report, it doesn't necessarily mean that it is exploitable. Also, we are very fortunate that even if exploitable, not all vulnerabilities have publicly available exploits, and especially ones that are available within the Metasploit framework. Otherwise we would have lots of script-kiddies running around armed and dangerous! On ...


2

If you want to keep yourself about the latest discovered security vulnerabilities, BugTraq would probably be your best bet. If you want to keep track of security breaches of organisations, the news would be your best bet. There is no consolidated resources that provide immediate feedback about such matters that I know of.


2

secunia makes a commercial product that does exactly what you want. "The Secunia VIM lets you create specific vulnerability management reports for different product categories across your entire IT infrastructure by filtering criteria. So you only get vulnerability alerts and intelligence relevant to your specific needs."


2

Debian provides a feed for its security advisories: http://www.debian.org/security/dsa. There is a link to each advisory which lists the CVE addressed by that fix. The debian-security-announce@debian.org mailing list provides the same information. These advisories have been declared CVE-compatible. The email and RSS feeds are the most timely way to retrieve ...


2

Yes, CVE-2014-0196 can be used for privilege escalation, because it allows overwriting buffers in the kernel outside the one allocated to your pty. This means that a non-privileged user could use it to become root. It's not limited to the friends that you've allowed access, either. If an attacker were able to compromise a service running on your system ...


2

PTS/QA You go to the package's QA page. For this, you either use the source package name (here "bind9"): http://packages.qa.debian.org/bind9 Or you use the binary package name (e.g. "bind9-host"): http://packages.debian.org/bind9-host If you used the binary one, click on the package in a distro (e.g. oldstable)¹, then on “Developer Information (PTS)” ...


2

CVE Details allows you to create a customized RSS feed with certain CVSS scores. : http://www.cvedetails.com/vulnerability-feeds-form.php However, I'm not sure if there's a way to filter out only Windows & Red Hat OS vulns.. but perhaps someone has an idea?


2

One difference is the ease to find a reliable and automated tool to check for compliance. I believe Nessus has templates available for most of the ones you have listed, but some are dated. In any case, I'd choose one that makes it as easy as possible for you to check and stay in compliance.


2

Here are some important considerations: What is the reason that you're hardening against a given benchmark or guideline? Are you going to be audited? Is there a preferred route or route the your auditors are more familiar with? What tools will you use for self auditing? Do those tools have polices or plugins to audit your system against a given ...


2

In general, DISA STIGs are more stringent than CIS Benchmarks. Keep in mind that with STIGs, what exact configurations are required depends on the classification of the system based on Mission Assurance Catagory (I-III) and Confidentiality Level (Public-Classified), giving you 9 different possible combinations of config requirements. CIS usually have a Level ...


1

mod_fcgi itself is not vulnerable: it talks to Apache through interprocess communication rather than the environment variables of traditional CGI. Any CGI scripts run through mod_fcgi can still be vulnerable if 1) they can be coerced into setting environment variables and 2) invoke bash (say, through a system() call or backtick interpolation).


1

Briefly: CVEs are for "known knowns" or specific vulnerabilities. CWEs are for "unknown knowns" or vulnerability types. Dynamic scanners are looking for instances of already-identified vulnerabilities. Static scanners do that, too, but one of their main advantages is that they are also looking for not-yet-identified new vulnerabilities. An obvious example ...


1

You can request a CVE number without the details being published. The timeline I have previously followed is: Notify vendor Request CVE number, while waiting for vendor response Publish advisory, once issue is fixed or a certain amount of time has passed I consider the CVE guys reasonably trustworthy, and I will disclose high-level details of the ...


1

If you apply for a CVE ID and are granted one, then the vulnerability will become public knowledge. It is recommended that you first contact the software developer and wait 30 days for their response. Depending on the severity of the vulnerability, they may ask that you do not make the vulnerability known to the public until they have had time to patch. ...


1

Most likely they would like to release a patch before making a public CVE. If they released a public CVE before they patched it would only hurt themselves, as the current version would be open to attack. Once they release a patch and are able to notify their customers, then I would expect that they would release a CVE to get the general public caught up.



Only top voted, non community-wiki answers of a minimum length are eligible