1

A while ago I came across this CVE-2017-5461, which is rated 9.8 both on NVD and Redhat Portal, with a CVSS base string of

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

for those who is not very familiar with CVSS scoring mechanism, let's break it apart, and I will elaborate my doubt following every element:

  • AV:N means Attack Vector is Network, this is clear;
  • AC:L means Attack Complexity is Low, Don't think so. as it require attacker to forge a special certificate.
  • PR:N means privilege is not required.
  • UI:N means user(victim) interaction is uneeded.
  • S:U means Scope is unchanged.
  • C:H means Confidentiality Impact is high. no doubtedly.
  • I:H means Integrity Impact is high. we can agree on that.
  • A:H means Availability Impact is high. how is this the case? why would a successful attempt break the availability of application?

Do you think this vulnerability qualify for a Critical vulnerability?

Improve this question
2
  • As I see on the link you provided for NVD, it says that it allows remote attackers to cause a denial of service. Hence it does break the availability. Not sure about the other questions, hence commenting.
    – pri
    Commented May 8, 2018 at 5:52
  • @PriyankGupta I've seen a lot of CVEs, usually the detrimental effects a vulnerability can bring are many. for example a memory corruption could very well end up with application crashed. but that's not the worst outcome, the worst outcome would be attacker crafted input causes remote code execution, that's when analysts should give a triple H to C/I/A, but in this case , apart from DoS which clearly does not affect confidientiality, the vulnerability only cause "unspecified impact".
    – Sajuuk
    Commented May 8, 2018 at 6:09

1 Answer 1

Reset to default
0

AC:L means Attack Complexity is Low,
Don't think so. as it require attacker to forge a special certificate.

I don't see why this should not count as low complexity. The attack does not require that the certificate is signed by a trusted CA since the bug is in parsing the certificate which is done before the trust chain can be checked.

A:H means Availability Impact is high.
how is this the case? why would a successful attempt break the availability of application?

From the bug description of what the attacker could do: "could cause it [the application] to crash or execute arbitrary code, using the permissions of the user running an application compiled against the NSS library.". In other words: the attacker can make the application to crash which definitely impacts the availability. Even worse, the attacker might be able to execute code with the permissions of the application which might further impact the availability and might also be used as a starting point to get deeper access using a local privilege escalation attack.

Improve this answer
4
  • but when the attacker causes the application to crash, how do the attack break confidentiality at the same time? in my view they are mutually excluded.
    – Sajuuk
    Commented May 8, 2018 at 6:21
  • @Sajuuk: if the application only crashes confidentially is not really impacted. But since the issue might allow code execution the attacker might be able to read data on the system which he is not supposed to read which impacts confidentially.
    – Steffen Ullrich
    Commented May 8, 2018 at 6:57
  • As far as I see, it have not to be done at the same time. In fact, these are possible (impacts on) for three of the CIA triad.
    – JackSparrow
    Commented May 8, 2018 at 6:57
  • @Sajuuk Read again: Not always. But this is also not the point here: "to crash or execute arbitrary code". This is where the confidentiality loss comes into play.
    – Tom K.
    Commented May 8, 2018 at 7:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .