0

I am currently interested in knowing how to write some proof-of-concept code for recent vulnerabilities that are released every month by the CVE and Microsoft Security Bulletin.

These websites list that vulnerabilities have occurred but they don't explain how the vulnerability works. For example Microsoft Security Bulletin has a very generic line describing how the vulnerability works-:

specially crafted Microsoft Word file

This doesn't give any information how the flaw works. CVE is also limited. I don't get the why information is not provided since the patch has already been released.

Are there resources anywhere on the web where I can get to know how recently released vulnerabilities work ?

  • I think you mean CVE instead of CWE. – Gumbo Dec 14 '14 at 9:14
  • @Gumbo Yes I guess so. Sorry for the confusion. Why doesn't it list any details on how the vulnerability works ? – Sreyan Dec 14 '14 at 17:40
  • 1
    Because everyone would be able to exploit it. – Gumbo Dec 14 '14 at 17:50
2

When exploits are first posted on CVE or others, the exploit discoverer usually provides code/description/POC to the vendor of the affected product.

This allows them to build a fix or patch.

If the information was provided publicly, it would allow any attacker to build an exploit.

The information posted publicly is enough to let sysadmins understand what they need to do immediately, before a patch becomes available.

  • So what if I wanted to write a POC from info taken from CVEs ? – Sreyan Dec 22 '14 at 18:48
  • 1
    Why would you want to? If you discover the vulnerability, you develop the Poc to show the vendor. If it isn't yours, the poc will have been provided to the vendor by the discoverer – Rory Alsop Dec 22 '14 at 19:42
  • If you do want to, using the CVE info requires you to work out the exploit. – Rory Alsop Dec 22 '14 at 19:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.