2

In National Vulnerability Database page (https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-0778), from the change history, we can see CVSS v3 scores has been changed overtime. For example, CVE-2016-0778 has this CVSS score when it was added: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. After sometime, they updated it to AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Here, AV - Attack Complexity is changing from Low to High. I think it means, the vulnerability is more difficult to exploit. why these changes are needed?

  • 1
    The thing to realise about CVSS is it's basically a subjective assessment of risk dressed up as an objective one through the use of formulas and numbers. I guess it could be useful in some cases to provide a rough starting point for vuln. ranking but I absolutely would not rely on it. – Rоry McCune Mar 22 '17 at 11:54
2

Generally speaking, vulnerabilities are rescored as they become better understood. It seems that Mitre often scores something in a worst case scenario and then lowers the score as the issue is studied some more.

As to the this particular vulnerability, it's not 100% clear, but the scoring was changed at the same time they made several other changes - one of which was adding the vendor advisory. That advisory states "The matching server code has never been shipped, but the client code was enabled by default and could be tricked by a malicious server into leaking client memory to the server, including private client user keys." So, for someone to take advantage of this vulnerability they would have to 1) write the appropriate server code and 2) get a server to use the modified version and 3) get a client to connect to the compromised server.

Now, take a look at a CVSS v3 calculator, for a low attack complexity it says "Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeated success against a vulnerable component." That clearly isn't the case as the attacker must have a compromised server (i.e. a specialized access condition). Now look at the description for high attack complexity, it says in part "a successful attack ... requires the attacker to invest in some measurable amount of effort in preparation of execution against the vulnerable component before a successful attack can be expected." Based on the advisory, that certainly seems to be the case.

Disclaimer: I had nothing to do with the scoring of this vulnerability by Mitre (though I do write advisories and score vulnerabilities for my employer), but given the information available, this change makes sense to me.

  • thanks, It is very informative. Do you mean you never use CVSS scores to record the vulnerabilities of your software? – Sarvar Nishonboev Mar 19 '17 at 20:48
  • 1
    No, quite the contrary, we always provide CVSS scores in our advisories. Here's the thing: our CVSS scores often differ from the one Mitre calculates - and Mitre's scores are usually higher. Why? They usually make assumptions that we know aren't the case. – Swashbuckler Mar 20 '17 at 0:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.