What happens once a vulnerability has been added to a database? That is, what can we (security/IT professionals) do about it? How do we find out what to do?

closed as unclear what you're asking by Anders, techraf, S.L. Barth, Matthew, Xander Oct 20 '16 at 16:17

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • I am not sure I understand what you mean? What is your goal? To fix the vulnerability? Are you interested in a specific case? – Anders Oct 19 '16 at 21:38
  • That is most often the wrong question. The right question would be: what has already been done, when the vulnerability was added to a CVE database?. Often the steps to take are already documented at that point. – grochmal Oct 19 '16 at 21:47

Giving it a CVE number (and adding it to a database) is just giving it a common name that can be used to refer to it. By itself, it does nothing.

But by that point, the people who have requested a CVE number be assigned to the vulnerability, have studied it and have prepared recommendations: a patch, a configuration workaround, a recommendation to shut off some software/hardware pending a fix.

What you do as a professional is up to you. You can decide to do nothing, or to apply the patch to all nodes, or to apply the patch in lab and see if it breaks something, or to switch vendors.

Not the answer you're looking for? Browse other questions tagged or ask your own question.