New answers tagged

0

Currently the NVD only pulls from the Mitre CVE database, this will be changing, but for now if Mitre doesn't have an entry written up, it won't be in the NVD database. As for Mitre I know we (Red Hat) have assigned over a thousand CVEs that aren't in the Mitre Database, and even some of the CVEs Mitre assigns (e.g. on oss-security@ mailing list) aren't in ...


0

Just an update, this process is changing, in addition to "evidence based" CVEs there will be "request based" CVEs (to be honest it's already a practice I have done for more then a few of the 5000 CVE's I have issued, certain people I trust to make requests properly and I don't require a lot of evidence because they have a history of doing their CVE requests ...


0

Try this one (https://blogs.securiteam.com/index.php/archives/2543#more-2543), the advisory shows the vulnerable code and since it's an open source product the patch is available from the vendor source code (http://www.live555.com/liveMedia/public/).


2

Risk scoring is not always clear-cut. Here are some of the considerations SSL Labs has to deal with when scoring a situation like this: Some servers have an operational need to support a wide variety of old or unpatched clients. Prioritizing stream ciphers over CBC ciphers can partially mitigate POODLE from a server's perspective, leaving it up to the ...


2

Ivan Ristic explains this in a blog post: In the short term, it’s possible to mitigate POODLE by avoiding using CBC suites with SSL 3, but that involves relying on a certain insecure stream cipher whose name no one wants to mention. I don’t recommend this approach. And that insecure stream cipher (suite) is this: TLS_RSA_WITH_RC4_128_SHA (0x5)



Top 50 recent answers are included