Eg Heartbleed, aka CVE-2014-0160, only has a CVE severity of 5.0. Yet the media went crazy about these bugs.

Is it because they have a cool name and a logo, or is the CVE severity metric somewhat flawed?

  • The PR department has better media contacts willing to hype the bug? – wireghoul Mar 5 '15 at 22:18

1) Cool names count. Don't discount the value of public relations.

2) Heartbleed, BEAST, CRIME, and POODLE all impacted (or could be be reached through) web servers. Web servers tend to be publicly available, widespread, and directly identified (in the minds of the press and non-technical public) as "THE INTERNET." Therefore, these issues had a wider possible impact and a higher perceived importance.

3) CVE tries to dispassionately describe how badly a vulnerability can hurt, but there is such a thing as the death of a million paper cuts. A CVE 9.5 that affects something rare and protected - say, Oracle database clusters - is never going to be as famous as a CVE of 4.2 that affects Apache.

4) The CVE itself doesn't take into account how ubiquitous a software package is throughout the world. Contrary to what I said in the comments below, there is one measure of ubiquity in the CVSS scoring; "target distribution (TD) metric measures the proportion of vulnerable systems in the environment". But "This measure is calculated subjectively, typically by affected parties" and so I believe that's not part of the NIST CVE, that's what gets adjusted by RedHat or Oracle when they release advisories based on the CVE. The bottom line is that CVE is not designed to determine how many people need to worry about an issue, but to determine exactly how worried those people should be if they own/use the impacted system

Take your pick of answers, there's some truth to all of them, as well as Xanders' commentary on the limitations of CVE.

It looks like FREAK is not going to cause a big splash despite having a cool name; it only impacts the subset of people who already don't care enough to make their web server secure. I'm actually kind of glad to see the press didn't get carried away just because it was ALL CAPS...

(Edited to add #4 with quotes from Wikipedia's CVSS page, just trying to round the comment chain up into the answer)

| improve this answer | |
  • I suspect you're right. So CVE severity doesn't take into account the protocol affected? (and therefore a weak bug in OpenSSL will be 'equal' in severity than a weak bug in some obscure system nobody uses?). That, compounded with the realization from the press that it affects them on their Macbook Pros, using the little padlocks on their screens, combined with a cool name and bleeding heart logo, means the media will make a fuss about it. \\ edit: actually, there does appear to be a section on the scoring for taking into account the protocol affected: en.wikipedia.org/wiki/CVSS – user69713 Mar 5 '15 at 22:50
  • "collateral damage potential" surely takes into account OpenSSL vs Oracle database clusters doesn't it? Perhaps it's not given enough weight? "target distribution" also seems relevant... – user69713 Mar 5 '15 at 22:55
  • Correct, the CVSS score doesn't reflect ubiquity of the target software. – gowenfawr Mar 5 '15 at 22:56
  • Apologies, see my edit. – user69713 Mar 5 '15 at 22:57
  • @user69713, not really. "The collateral damage potential (CDP) metric measures the potential loss or impact on either physical assets such as equipment (and lives), or the financial impact upon the affected organisation if the vulnerability is exploited" Wikipedia. If that Oracle cluster has medication tracking for a few large hospitals, it could easily exceed the impact on lives of all the Apache servers in the world. – gowenfawr Mar 5 '15 at 22:58

The process for assigning a CVE's CVSS score to a vulnerability is very prescriptive. There is little room for interpretation, or to account for impacts which the are not accounted for by the scoring formula. So, in the end some relatively major issues will end up with oddly low scores, and some relatively trivial issues will end up with excessively high scores. This is the nature of the system, and one of its limitations. Heartbleed is probably a prime example of an vulnerability that had a CVSS score that did not appropriately reflect the real world impact.

To elaborate on an example: CVSS explicitly excludes indirect or second-order effects from scoring. This is reasonably from a standardization perspective, otherwise you end up with wild speculation about how vulnerabilities might be exploited drastically driving up scores to a point where they can no longer be accurately differentiated. However, in the case of a vulnerability like Heartbleed, this means that the fact that critical data like authentication credentials, and certificate private keys were demonstrably at risk (in the real world, even, not just in a PoC) wasn't taken into account by the CVSS scoring. So, the CVE has a medium CVSS score of 5.0, and at them same time, sysadmins everywhere scrambled to patch systems and remediate any potential harm as soon as humanly possible, recognizing the vulnerability for the highly critical and time-sensitive risk it actually was.

Regarding why some issues become famous...Well, because they catch the public's attention. Fame is capricious and fleeting, and time spent worrying about it is time wasted.

| improve this answer | |
  • Can you elaborate in what sense the heartbleed bug should be considered more severe and isn't captured by the CVE severity metric? – user69713 Mar 5 '15 at 22:39
  • @user69713 I've updated the post with the requested elaboration. – Xander Mar 5 '15 at 22:55
  • Thanks for your answer. So, people feared Heartbleed more because you could literally show how easy it was to exploit very simply, and the damage is severe and you can get away with it. This, combined with a cool name, logo and the public realizing it actually affects them in a concrete way, explains how it became so well known. – user69713 Mar 6 '15 at 12:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.