68
votes
Accepted
Are CVE counts a good indicator of a software's security?
Can we say that a software is "more secure" than another, based on the number of CVEs these softwares have?
No. CVE entries are not a good source to rank products by their "overall security".
The ...
- 44.7k
66
votes
Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes?
You can do either, but I recommend applying for a CVE so that customers who get threat intelligence feeds are more likely to notice the issue and expedite a patch. Assigning a CVE also makes it easier ...
- 135k
43
votes
How useful are CVE entries?
They're useful, they're just not useful for building exploits. They're not useful for determining how buggy a software is for that matter either...The number of CVEs has no strong correlation with ...
- 35.8k
25
votes
Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes?
It would be helpful to publish the CVE so that others know it's necessary to update: as you said, they can see it in threat intelligence feeds (or CVE scans) instead of having to read the changelog of ...
- 32.7k
22
votes
How useful are CVE entries?
The main use case for CVE is to have unique identifiers for software vulnerabilities. It is not a good tool to measure a product's overall security and won't help you with the in-depth analysis of a ...
- 44.7k
18
votes
Accepted
How to read CVE - 2016 - 5696 correctly
Does the version next to pending refer to kernel version for which the fix is released?
Yes- more precisely, the version next to "pending" refers to the version of the package within the ...
- 3,487
15
votes
Accepted
Would CVE-2016-0728 affect Docker?
This is not a privilege escalation where code gets "only" executed as a higher privileged user. This issue is about execution of code inside the Linux kernel, i.e. the kernel which gets shared between ...
- 198k
13
votes
How useful are CVE entries?
CVEs are useful in several ways.
First, and perhaps most importantly, they provide a common term for a particular vulnerability. This makes it easy to ensure that when someone says "did you see that ...
- 9,432
11
votes
Accepted
What is the reason for the increase of CVEs since 2017?
Until 2016, MITRE was having trouble assigning CVEs. The process was cumbersome, it took a very long time, and more often than not, researchers simply didn't get a CVE assigned.
In 2017, MITRE ...
- 29.5k
10
votes
Accepted
Should CVE be assigned to an application even if the vulnerability is in a vulnerable 3rd-party library?
From the CVE Numbering Authority (CNA) Rules:
2.1.2
2.1.2 If a CVE ID is being assigned to a vulnerability, the CNA MUST make a reasonable effort to notify the maintainer of the code in which that ...
- 14.7k
8
votes
CVE-2017-7494 Samba remote call. How do I know if Samba is running or not on my Ubuntu server?
I feel that the other answers, while undoubtedly useful, do not answer exactly what you asked for... that is, whether Samba is running, but either whether Samba was installed at some time (by looking ...
- 22.8k
8
votes
Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes?
You are not required to request a CVE, but you are free to do so when you think it will be benificial.
A CVE is just a central number that identifies a vulnerability, which can assist when ...
- 29.6k
8
votes
Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes?
I think the most important question is if your product comes with an auto-updater. If it auto-updates by default, then a CVE can sometimes do more harm than good by putting your product into the ...
- 1,837
7
votes
How to subscribe to information about new vulnerabilities in selected products?
It is possible to make a custom list of products / vendors / keywords using Cassandra service from Purdue University. It is free and allows updates to be emailed.
- 170
7
votes
Did CVE-2016-2324 allowed remote code execution?
A buffer overflow (of the "write" kind) gives any advantage to an attacker only if the attacker can arrange for the overflow to spill over other bytes that are used for something else. At any time, ...
- 326k
7
votes
Accepted
CVE-2017-7494 Samba remote call. How do I know if Samba is running or not on my Ubuntu server?
It certainly looks likely it's not installed. Try checking with your package manager as to what's installed as a final check. But I would say it looks like it is not installed.
You could also do a ...
- 3,270
6
votes
Are CVE counts a good indicator of a software's security?
As a voluntary system, CVE is as open to abuse as the software products it tracks and is often highly subjective. This is somewhat compounded by the scoring mechanism that's used to track severity ...
- 186
6
votes
CVE-2017-7494 Samba remote call. How do I know if Samba is running or not on my Ubuntu server?
You can check with $ dpkg -L samba
- 161
6
votes
Can A chain of exploits count as a CVE?
would the entire chain of them be eligible for A CVE or would each of
the individual one be eligible?
Each CVE is intended to represent a single vulnerability. Potential CVEs are more likely to be ...
- 72.7k
6
votes
How Vulnerability scanners assign CVE codes to Vulnerability found
Usually it'll be the other way around, a scanner will have a list of known CVEs and how to test for them. It will then give you a filtered version of that list based on which vunerabilities apply to ...
- 1,096
6
votes
Accepted
Does CVE-2020-0601 (CRYPT32.DLL critical exploit) affect Windows 7 and is there a patch to fix it?
After seeing multiple answers with mixed conclusions here and in Google searches, as well as no thorough explanations on whether or not Windows 7 is effected by this vulnerability, I took it upon ...
- 870
6
votes
Accepted
WireGuard / CVE-2019-14899: How secure the protocol really is?
Is this information technically correct?
Yes, but please note that there is a modification of the previous attack which cannot be stopped by the previously recommended mitigations - see Blind In/On-...
- 198k
6
votes
Accepted
How can we disable sudo on CentOS 6 to prevent CVE-2021-3156?
How to disable sudo on CentOS 6 to prevent CVE-2021-3156?
chmod 0644 /usr/bin/sudo will effectively disable sudo for non-root users. It removes the setguid bit, so sudo will work as epxected for ...
- 15.4k
5
votes
How can I report a new vulnerability to cve.mitre.org such that they assign a CVE ID to it?
[Note: see the answer by @tim, which is a more thorough anwser than my quick google.]
MITRE has official documentation that answers your question right on cve.mitre.org, specifically have a look at ...
- 58.8k
5
votes
Accepted
How can CVE-2016-2324 and -2315 be mitigated on Mac OS X?
Most developers I know who are using OS X are using Homebrew for a variety of reasons; in addition to providing easy installation of tools not available from Apple, the updated versions of Apple-...
- 9,432
5
votes
How many security-related websites/sofware/system/human brain will break when we get more than 10000 CVEs a year?
The solution for running out of space in the CVE numbering scheme was to change to a "new format" that allows for additional digits in the last part of the CVE ID as needed. A request for input into ...
- 27.1k
5
votes
Accepted
How many security-related websites/sofware/system/human brain will break when we get more than 10000 CVEs a year?
The industry will not fall apart, because such an outcome would mean that the industry at large minds CVE numbers and acknowledges their existence; the day this will become true will be a glorious day ...
- 326k
5
votes
Accepted
How to exactly create a CVE?
As Ohnana also mentioned the way to request a formal CVE is through their intake form.
https://cve.mitre.org/cve/request_id.html
Details from a current snapshot of that website
Main Methods
Contact ...
- 14.2k
5
votes
What to do if you think you discovered a zero day vulnerability? (white hat style)
There is An ISO dedicated to this subject https://www.iso.org/standard/45170.html
It is generally accepted to work with the vendor affected and give them time to resolve the issue within a reasonable ...
- 81
Only top scored, non community-wiki answers of a minimum length are eligible