Hot answers tagged

68 votes
Accepted

Are CVE counts a good indicator of a software's security?

Can we say that a software is "more secure" than another, based on the number of CVEs these softwares have? No. CVE entries are not a good source to rank products by their "overall security". The ...
Arminius's user avatar
  • 44.7k
66 votes

Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes?

You can do either, but I recommend applying for a CVE so that customers who get threat intelligence feeds are more likely to notice the issue and expedite a patch. Assigning a CVE also makes it easier ...
Polynomial's user avatar
  • 135k
43 votes

How useful are CVE entries?

They're useful, they're just not useful for building exploits. They're not useful for determining how buggy a software is for that matter either...The number of CVEs has no strong correlation with ...
Xander's user avatar
  • 35.8k
25 votes

Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes?

It would be helpful to publish the CVE so that others know it's necessary to update: as you said, they can see it in threat intelligence feeds (or CVE scans) instead of having to read the changelog of ...
Luc's user avatar
  • 32.7k
22 votes

How useful are CVE entries?

The main use case for CVE is to have unique identifiers for software vulnerabilities. It is not a good tool to measure a product's overall security and won't help you with the in-depth analysis of a ...
Arminius's user avatar
  • 44.7k
18 votes
Accepted

How to read CVE - 2016 - 5696 correctly

Does the version next to pending refer to kernel version for which the fix is released? Yes- more precisely, the version next to "pending" refers to the version of the package within the ...
Jonah Benton's user avatar
  • 3,487
15 votes
Accepted

Would CVE-2016-0728 affect Docker?

This is not a privilege escalation where code gets "only" executed as a higher privileged user. This issue is about execution of code inside the Linux kernel, i.e. the kernel which gets shared between ...
Steffen Ullrich's user avatar
13 votes

How useful are CVE entries?

CVEs are useful in several ways. First, and perhaps most importantly, they provide a common term for a particular vulnerability. This makes it easy to ensure that when someone says "did you see that ...
Xiong Chiamiov's user avatar
11 votes
Accepted

What is the reason for the increase of CVEs since 2017?

Until 2016, MITRE was having trouble assigning CVEs. The process was cumbersome, it took a very long time, and more often than not, researchers simply didn't get a CVE assigned. In 2017, MITRE ...
tim's user avatar
  • 29.5k
10 votes
Accepted

Should CVE be assigned to an application even if the vulnerability is in a vulnerable 3rd-party library?

From the CVE Numbering Authority (CNA) Rules: 2.1.2 2.1.2 If a CVE ID is being assigned to a vulnerability, the CNA MUST make a reasonable effort to notify the maintainer of the code in which that ...
Benoit Esnard's user avatar
8 votes

CVE-2017-7494 Samba remote call. How do I know if Samba is running or not on my Ubuntu server?

I feel that the other answers, while undoubtedly useful, do not answer exactly what you asked for... that is, whether Samba is running, but either whether Samba was installed at some time (by looking ...
LSerni's user avatar
  • 22.8k
8 votes

Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes?

You are not required to request a CVE, but you are free to do so when you think it will be benificial. A CVE is just a central number that identifies a vulnerability, which can assist when ...
Sjoerd's user avatar
  • 29.6k
8 votes

Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes?

I think the most important question is if your product comes with an auto-updater. If it auto-updates by default, then a CVE can sometimes do more harm than good by putting your product into the ...
Nosajimiki's user avatar
  • 1,837
7 votes

How to subscribe to information about new vulnerabilities in selected products?

It is possible to make a custom list of products / vendors / keywords using Cassandra service from Purdue University. It is free and allows updates to be emailed.
GoodMirek's user avatar
  • 170
7 votes

Did CVE-2016-2324 allowed remote code execution?

A buffer overflow (of the "write" kind) gives any advantage to an attacker only if the attacker can arrange for the overflow to spill over other bytes that are used for something else. At any time, ...
Thomas Pornin's user avatar
7 votes
Accepted

CVE-2017-7494 Samba remote call. How do I know if Samba is running or not on my Ubuntu server?

It certainly looks likely it's not installed. Try checking with your package manager as to what's installed as a final check. But I would say it looks like it is not installed. You could also do a ...
ISMSDEV's user avatar
  • 3,270
6 votes

Are CVE counts a good indicator of a software's security?

As a voluntary system, CVE is as open to abuse as the software products it tracks and is often highly subjective. This is somewhat compounded by the scoring mechanism that's used to track severity ...
Rob C's user avatar
  • 186
6 votes

CVE-2017-7494 Samba remote call. How do I know if Samba is running or not on my Ubuntu server?

You can check with $ dpkg -L samba
hailinzeng's user avatar
6 votes

Can A chain of exploits count as a CVE?

would the entire chain of them be eligible for A CVE or would each of the individual one be eligible? Each CVE is intended to represent a single vulnerability. Potential CVEs are more likely to be ...
gowenfawr's user avatar
  • 72.7k
6 votes

How Vulnerability scanners assign CVE codes to Vulnerability found

Usually it'll be the other way around, a scanner will have a list of known CVEs and how to test for them. It will then give you a filtered version of that list based on which vunerabilities apply to ...
Jenessa's user avatar
  • 1,096
6 votes
Accepted

Does CVE-2020-0601 (CRYPT32.DLL critical exploit) affect Windows 7 and is there a patch to fix it?

After seeing multiple answers with mixed conclusions here and in Google searches, as well as no thorough explanations on whether or not Windows 7 is effected by this vulnerability, I took it upon ...
xorist's user avatar
  • 870
6 votes
Accepted

WireGuard / CVE-2019-14899: How secure the protocol really is?

Is this information technically correct? Yes, but please note that there is a modification of the previous attack which cannot be stopped by the previously recommended mitigations - see Blind In/On-...
Steffen Ullrich's user avatar
6 votes
Accepted

How can we disable sudo on CentOS 6 to prevent CVE-2021-3156?

How to disable sudo on CentOS 6 to prevent CVE-2021-3156? chmod 0644 /usr/bin/sudo will effectively disable sudo for non-root users. It removes the setguid bit, so sudo will work as epxected for ...
vidarlo's user avatar
  • 15.4k
5 votes

How can I report a new vulnerability to cve.mitre.org such that they assign a CVE ID to it?

[Note: see the answer by @tim, which is a more thorough anwser than my quick google.] MITRE has official documentation that answers your question right on cve.mitre.org, specifically have a look at ...
Mike Ounsworth's user avatar
5 votes
Accepted

How can CVE-2016-2324 and -2315 be mitigated on Mac OS X?

Most developers I know who are using OS X are using Homebrew for a variety of reasons; in addition to providing easy installation of tools not available from Apple, the updated versions of Apple-...
Xiong Chiamiov's user avatar
5 votes

How many security-related websites/sofware/system/human brain will break when we get more than 10000 CVEs a year?

The solution for running out of space in the CVE numbering scheme was to change to a "new format" that allows for additional digits in the last part of the CVE ID as needed. A request for input into ...
Iszi's user avatar
  • 27.1k
5 votes
Accepted

How many security-related websites/sofware/system/human brain will break when we get more than 10000 CVEs a year?

The industry will not fall apart, because such an outcome would mean that the industry at large minds CVE numbers and acknowledges their existence; the day this will become true will be a glorious day ...
Thomas Pornin's user avatar
5 votes
Accepted

How to exactly create a CVE?

As Ohnana also mentioned the way to request a formal CVE is through their intake form. https://cve.mitre.org/cve/request_id.html Details from a current snapshot of that website Main Methods Contact ...
Trey Blalock's user avatar
  • 14.2k
5 votes

What to do if you think you discovered a zero day vulnerability? (white hat style)

There is An ISO dedicated to this subject https://www.iso.org/standard/45170.html It is generally accepted to work with the vendor affected and give them time to resolve the issue within a reasonable ...
Greg's user avatar
  • 81

Only top scored, non community-wiki answers of a minimum length are eligible