2

The Common Vulnerabilities and Exposures (CVE) system is a dictionary of publicly known information security vulnerabilities and exposures in publicly released software packages.

I am looking for a canonical answer to the following questions:

  • How do CVEs work?

  • How do you find a CVE related to a particular product?

  • Where can I find a hotfix for a CVE?

  • Do all listed CVEs have hotfixes?

  • What do I do if I can't find a hotfix for a listed CVE?

I have run a google search to identify, collect and view CVEs for different products. The results vary however, and I was hoping we would be able to use my question as a basis from which users can become aware of the CVE system, and can following a step-by-step procedure for identifying and collecting product CVEs.

1
  • 1
    This is hardly a complete answer, but cvedetails.com is an awesome resource for searching CVEs. Jun 26, 2015 at 2:10

1 Answer 1

4

As the name suggests it, CVE are divided to two categories: Vulnerabilities and Exposures both are mainly errors in a given software code or its configuration that respectively may allow an attacker to -for example- gain a privilege escalation (running a code as root on a user level environment) or to gain an indirect access to a system/network.

Before trying (at least) to adresse your points, its important to keep in mind that the very first stage of creating a CVE is discovering and disclosing a vulnerability. And for the sake of simplicity :

  • How do CVEs work?: Once a vulnerability is discovered and disclosed, CVE Numbering Authorities (CNA) assigns this vulnerability a CVE ID then post the CVE on the CVE List
  • How do you find a CVE related to a particular product?: There are many repositories around, like the one suggested by @bonsaiviking, you can use https://cve.mitre.org/, https://www.cvedetails.com/ or https://nvd.nist.gov/...
  • Where can I find a hotfix for a CVE?: Generally hot fixes are updates pushed by affected software vendors, this why its important to keep its Os, Softwares, Web browsers updated.
  • Do all listed CVEs have hotfixes? To make it simple, the answer is NO, researchers and bug hunters usually respect what is called Vulnerability Disclosure Policy, to make it simple, a typical disclose starts by contacting the affected vendor and making it aware of the found vulnerability, by providing it a Proof of Concept for example and technical details, the vendor should correct the concerned vulnerability within 90 days passing this deadline, the vulnerability could be disclosed, IF t this happens, then the "bug" is assigned a CVE.
  • What do I do if I can't find a hotfix for a listed CVE? In general, nothing except waiting an update from the vendor or avoiding the use of the affected software.

The answer was not exhaustive but hope it helped !

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .