2

The Common Vulnerabilities and Exposures (CVE) system is a dictionary of publicly known information security vulnerabilities and exposures in publicly released software packages.

I am looking for a canonical answer to the following questions:

  • How do CVEs work?

  • How do you find a CVE related to a particular product?

  • Where can I find a hotfix for a CVE?

  • Do all listed CVEs have hotfixes?

  • What do I do if I can't find a hotfix for a listed CVE?

I have run a google search to identify, collect and view CVEs for different products. The results vary however, and I was hoping we would be able to use my question as a basis from which users can become aware of the CVE system, and can following a step-by-step procedure for identifying and collecting product CVEs.

  • 1
    This is hardly a complete answer, but cvedetails.com is an awesome resource for searching CVEs. – bonsaiviking Jun 26 '15 at 2:10
4

As the name suggests it, CVE are divided to two categories: Vulnerabilities and Exposures both are mainly errors in a given software code or its configuration that respectively may allow an attacker to -for example- gain a privilege escalation (running a code as root on a user level environment) or to gain an indirect access to a system/network.

Before trying (at least) to adresse your points, its important to keep in mind that the very first stage of creating a CVE is discovering and disclosing a vulnerability. And for the sake of simplicity :

  • How do CVEs work?: Once a vulnerability is discovered and disclosed, CVE Numbering Authorities (CNA) assigns this vulnerability a CVE ID then post the CVE on the CVE List
  • How do you find a CVE related to a particular product?: There are many repositories around, like the one suggested by @bonsaiviking, you can use https://cve.mitre.org/, https://www.cvedetails.com/ or https://nvd.nist.gov/...
  • Where can I find a hotfix for a CVE?: Generally hot fixes are updates pushed by affected software vendors, this why its important to keep its Os, Softwares, Web browsers updated.
  • Do all listed CVEs have hotfixes? To make it simple, the answer is NO, researchers and bug hunters usually respect what is called Vulnerability Disclosure Policy, to make it simple, a typical disclose starts by contacting the affected vendor and making it aware of the found vulnerability, by providing it a Proof of Concept for example and technical details, the vendor should correct the concerned vulnerability within 90 days passing this deadline, the vulnerability could be disclosed, IF t this happens, then the "bug" is assigned a CVE.
  • What do I do if I can't find a hotfix for a listed CVE? In general, nothing except waiting an update from the vendor or avoiding the use of the affected software.

The answer was not exhaustive but hope it helped !

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.