67
Can we say that a software is "more secure" than another, based on the number of CVEs these softwares have?
No. CVE entries are not a good source to rank products by their "overall security".
The main idea behind the CVE system is to create unique identifiers for software vulnerabilities. It's not designed to be a complete and verified database of all ...
66
You can do either, but I recommend applying for a CVE so that customers who get threat intelligence feeds are more likely to notice the issue and expedite a patch. Assigning a CVE also makes it easier to reference a specific vulnerability in general communications if you need to later. It's also a signal to your customers that you take security transparency ...
42
They're useful, they're just not useful for building exploits. They're not useful for determining how buggy a software is for that matter either...The number of CVEs has no strong correlation with code quality.
What they are useful for, is determining, as an administrator, if the versions of a given software package you're using has been patched for ...
27
I think this is a "trend effect" which is also the drive under everything about fashion (in the "clothing" sense). Please allow the local Frenchman to talk about fashion.
Fashion is a deeply self-contradictory social behaviour. People who follow fashions seek both:
to gain acceptance in a given local group by displaying adherence to perceived agreed upon ...
25
It would be helpful to publish the CVE so that others know it's necessary to update: as you said, they can see it in threat intelligence feeds (or CVE scans) instead of having to read the changelog of every update to decide whether they need to update.
Additionally, as a pentester, it helps us a lot in our work. If we find SAPConnectorDeluxe 4.1.39, the ...
21
The main use case for CVE is to have unique identifiers for software vulnerabilities. It is not a good tool to measure a product's overall security and won't help you with the in-depth analysis of a bug.
You should think of CVE as a dictionary rather than a database that assigns standard names to vulnerabilities so that you can unambiguously refer to them ...
16
Given you have referenced Github, I will assume this related to some type of As an open source project, a note to oss-sec is a good idea. This will bring it to the attention of most upstream distributors.
You do not need to subscribe to post to oss-sec, but you should note carefully the etiquette/content guidelines in the link above. A rummage through the ...
15
This is not a privilege escalation where code gets "only" executed as a higher privileged user. This issue is about execution of code inside the Linux kernel, i.e. the kernel which gets shared between all docker instances and the OS containing the docker instances. This is the highest privilege one could get and at this level one can bypass any kind of ...
15
Does the version next to pending refer to kernel version for which the fix is released?
Yes- more precisely, the version next to "pending" refers to the version of the package within the lineage in which the fix is included.
There are lots of binary packagings of the upstream kernel sources for different hardware platforms and other use cases- &...
13
It's because the vulnerability was actually first discovered in 2010 (even if it wasn't reported as a security issue back then, just as a bug), and rediscovered again in 2014 by Ted Unangst after heartbleed became the straw that broke the camel back, and this time correctly identified as an issue with security implications.
Original bug report : https://rt....
13
Why don't some vulnerabilities have CVE numbers?
It's usually either that the entity who found the vulnerability didn't care to request one, or that, for some reason, a CVE Numbering Authority (CNA) or MITRE themselves decided not to include the vulnerability in the system.
Why are CVE entries sometimes empty?
The CVE number assignment procedure ...
12
Go to CVE Details' Product or Vendor pages. There is "Vulnerability Feeds & Widgets" link there.
It allows you to subscribe to CVEs about selected vendor/product.
12
CVEs are useful in several ways.
First, and perhaps most importantly, they provide a common term for a particular vulnerability. This makes it easy to ensure that when someone says "did you see that Android vulnerability", you're talking about the same Android vulnerability. It also vastly simplifies searching for more information on the issue.
Secondly, ...
10
From the CVE FAQ:
An information security vulnerability is a mistake in software that
can be directly used by a hacker to gain access to a system or
network. See the Terminology page for a complete explanation of how
this term is used on the CVE Web site.
The intention of CVE is to be comprehensive with respect to all
publicly known ...
10
Until 2016, MITRE was having trouble assigning CVEs. The process was cumbersome, it took a very long time, and more often than not, researchers simply didn't get a CVE assigned.
In 2017, MITRE changed their assignment process. They created a web form, and are now assigning CVEs in a matter of hours or days. They also outsourced the assignment of CVEs for ...
8
In general, DISA STIGs are more stringent than CIS Benchmarks. Keep in mind that with STIGs, what exact configurations are required depends on the classification of the system based on Mission Assurance Category (I-III) and Confidentiality Level (Public-Classified), giving you nine different possible combinations of configuration requirements. CIS usually ...
8
I feel that the other answers, while undoubtedly useful, do not answer exactly what you asked for... that is, whether Samba is running, but either whether Samba was installed at some time (by looking at files on disk, which might be left over) or whether Samba is installed with the system's knowledge, which might not be always the case.
dpkg will not tell ...
8
You are not required to request a CVE, but you are free to do so when you think it will be benificial.
A CVE is just a central number that identifies a vulnerability, which can assist when communicating about vulnerabilities. CVE's are particularly helpful when there are multiple parties involved. Anyone can request a CVE in your product, but in my opinion ...
7
There are multiple ways to obtain a CVE.
One could contact one of the CVE Numbering Authorities (CNA), an emergency response team (think CERT) or the CVE project. If the vendor of a product is listed as a CNA you must contact the vendor to obtain a CVE.
Sufficient information must be provided to allow the CVE assigner to take a decision (provide the CVE, ...
7
If you are looking for the vulnerability reports and databases, I've already answered this in this stackoverflow answer.
Copy-pasting again for easy reference:
Common Vulnerabilities and Exposures project (CVE)
http://seclists.org/fulldisclosure
http://packetstormsecurity.org/
http://www.securityfocus.com/bid/ (BugTraq)
http://www.exploit-db.com/
Various ...
7
So it appears that the Red Hat errata and CentOS errata are the same numbers.
This is Red Hat's format:
RHSA-YYYY-####
And this is CentOS' format:
CESA-YYYY:####
Where #### is the same number for both. So, to solve your example question, here's what I did:
I went on the RedHat site and searched for the CVE number. This led me to the CVE page that ...
7
A buffer overflow (of the "write" kind) gives any advantage to an attacker only if the attacker can arrange for the overflow to spill over other bytes that are used for something else. At any time, the process runs in an address space, most of which being unallocated. If the buffer which is overflown is at the end of the address space, or is followed only by ...
7
It certainly looks likely it's not installed. Try checking with your package manager as to what's installed as a final check. But I would say it looks like it is not installed.
You could also do a search for the executable by using
find / -executable -name samba
7
I think the most important question is if your product comes with an auto-updater. If it auto-updates by default, then a CVE can sometimes do more harm than good by putting your product into the realm of awareness for many hackers who may otherwise not know you even exist. They can see your CVE history, and get a good feeling about your security posture. ...
6
I'm not aware of any good out-of-the-box services, but I usually cross-reference with sites like:
SecurityFocus: It usually references CVE. Patch status filed under "Solution".
PacketStormSecurity: Allows fulltext search (can search for CVE ID). Patch status filed under "Mitigation".
OSVDB: Has an option to search with CVE ID. Patch status filed under "...
6
The most reliable source, is probably Metasploit's vulnerability & exploits DB - But some alternate sources do exist:
You can use Exploit-DB search to search by CVE exploits by "metasploit" e.g.:
http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description=&filter_exploit_text=&filter_author=metasploit&...
6
Excellent infographic! Unless someone were to actually sit-down and read through the various CVE's and understand them in-and-out, it would be difficult to provide any sort of substantial answer. That said, I'm willing to conjecture wildly here.
Browser creep -- with three main-stream browsers (IE, Firefox, and Chrome) the plugins have to be developed ...
6
As a voluntary system, CVE is as open to abuse as the software products it tracks and is often highly subjective. This is somewhat compounded by the scoring mechanism that's used to track severity which is typically CVSSv2.
In an ideal world, when a vulnerability is discovered in a product the developers will register a CVE, later publishing it along with ...
6
You can check with $ dpkg -L samba
6
would the entire chain of them be eligible for A CVE or would each of
the individual one be eligible?
Each CVE is intended to represent a single vulnerability. Potential CVEs are more likely to be split up for finer granularity than merged.
The current guidance for this process is the Process to Correct Counting Issues, and the section on merging only ...
Only top voted, non community-wiki answers of a minimum length are eligible
