Hot answers tagged

67 votes
Accepted

Are CVE counts a good indicator of a software's security?

Can we say that a software is "more secure" than another, based on the number of CVEs these softwares have? No. CVE entries are not a good source to rank products by their "overall security". The ...
user avatar
  • 43.7k
66 votes

Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes?

You can do either, but I recommend applying for a CVE so that customers who get threat intelligence feeds are more likely to notice the issue and expedite a patch. Assigning a CVE also makes it easier ...
user avatar
  • 132k
43 votes

How useful are CVE entries?

They're useful, they're just not useful for building exploits. They're not useful for determining how buggy a software is for that matter either...The number of CVEs has no strong correlation with ...
user avatar
  • 35.5k
25 votes

Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes?

It would be helpful to publish the CVE so that others know it's necessary to update: as you said, they can see it in threat intelligence feeds (or CVE scans) instead of having to read the changelog of ...
user avatar
  • 31.8k
22 votes

How useful are CVE entries?

The main use case for CVE is to have unique identifiers for software vulnerabilities. It is not a good tool to measure a product's overall security and won't help you with the in-depth analysis of a ...
user avatar
  • 43.7k
16 votes
Accepted

What to do after you get a CVE?

Given you have referenced Github, I will assume this related to some type of As an open source project, a note to oss-sec is a good idea. This will bring it to the attention of most upstream ...
user avatar
  • 7,917
15 votes
Accepted

Would CVE-2016-0728 affect Docker?

This is not a privilege escalation where code gets "only" executed as a higher privileged user. This issue is about execution of code inside the Linux kernel, i.e. the kernel which gets shared between ...
user avatar
15 votes
Accepted

How to read CVE - 2016 - 5696 correctly

Does the version next to pending refer to kernel version for which the fix is released? Yes- more precisely, the version next to "pending" refers to the version of the package within the ...
user avatar
  • 3,329
14 votes
Accepted

Why is the code CVE-2010-5298 used for a vulnerability discovered in 2014?

It's because the vulnerability was actually first discovered in 2010 (even if it wasn't reported as a security issue back then, just as a bug), and rediscovered again in 2014 by Ted Unangst after ...
user avatar
  • 4,608
14 votes

Why do some known vulnerabilities have no CVE ID?

Why don't some vulnerabilities have CVE numbers? It's usually either that the entity who found the vulnerability didn't care to request one, or that, for some reason, a CVE Numbering Authority (CNA) ...
user avatar
  • 43.7k
13 votes

How useful are CVE entries?

CVEs are useful in several ways. First, and perhaps most importantly, they provide a common term for a particular vulnerability. This makes it easy to ensure that when someone says "did you see that ...
user avatar
11 votes
Accepted

What is the reason for the increase of CVEs since 2017?

Until 2016, MITRE was having trouble assigning CVEs. The process was cumbersome, it took a very long time, and more often than not, researchers simply didn't get a CVE assigned. In 2017, MITRE ...
user avatar
  • 29k
9 votes
Accepted

Should CVE be assigned to an application even if the vulnerability is in a vulnerable 3rd-party library?

From the CVE Numbering Authority (CNA) Rules: 2.1.2 2.1.2 If a CVE ID is being assigned to a vulnerability, the CNA MUST make a reasonable effort to notify the maintainer of the code in which that ...
user avatar
8 votes

Difference between hardening guides (CIS, NSA, DISA)

In general, DISA STIGs are more stringent than CIS Benchmarks. Keep in mind that with STIGs, what exact configurations are required depends on the classification of the system based on Mission ...
user avatar
8 votes
Accepted

CentOS Security Tracker

So it appears that the Red Hat errata and CentOS errata are the same numbers. This is Red Hat's format: RHSA-YYYY-#### And this is CentOS' format: CESA-YYYY:#### Where #### is the same number ...
user avatar
  • 4,737
8 votes

CVE-2017-7494 Samba remote call. How do I know if Samba is running or not on my Ubuntu server?

I feel that the other answers, while undoubtedly useful, do not answer exactly what you asked for... that is, whether Samba is running, but either whether Samba was installed at some time (by looking ...
user avatar
  • 22.5k
8 votes

Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes?

You are not required to request a CVE, but you are free to do so when you think it will be benificial. A CVE is just a central number that identifies a vulnerability, which can assist when ...
user avatar
  • 28.6k
7 votes

How to subscribe to information about new vulnerabilities in selected products?

It is possible to make a custom list of products / vendors / keywords using Cassandra service from Purdue University. It is free and allows updates to be emailed.
user avatar
7 votes

Did CVE-2016-2324 allowed remote code execution?

A buffer overflow (of the "write" kind) gives any advantage to an attacker only if the attacker can arrange for the overflow to spill over other bytes that are used for something else. At any time, ...
user avatar
7 votes
Accepted

CVE-2017-7494 Samba remote call. How do I know if Samba is running or not on my Ubuntu server?

It certainly looks likely it's not installed. Try checking with your package manager as to what's installed as a final check. But I would say it looks like it is not installed. You could also do a ...
user avatar
  • 3,262
7 votes

Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes?

I think the most important question is if your product comes with an auto-updater. If it auto-updates by default, then a CVE can sometimes do more harm than good by putting your product into the ...
user avatar
  • 1,799
6 votes
Accepted

Notifications (RSS or mailing list) of CVE with high scores for Windows and Red Hat?

CVE Details allows you to create a customized RSS feed with certain CVSS scores. : http://www.cvedetails.com/vulnerability-feeds-form.php However, I'm not sure if there's a way to filter out only ...
user avatar
  • 86
6 votes

How can I report a new vulnerability to cve.mitre.org such that they assign a CVE ID to it?

[Note: see the answer by @tim, which is a more thorough anwser than my quick google.] MITRE has official documentation that answers your question right on cve.mitre.org, specifically have a look at ...
user avatar
6 votes

Are CVE counts a good indicator of a software's security?

As a voluntary system, CVE is as open to abuse as the software products it tracks and is often highly subjective. This is somewhat compounded by the scoring mechanism that's used to track severity ...
user avatar
  • 186
6 votes

CVE-2017-7494 Samba remote call. How do I know if Samba is running or not on my Ubuntu server?

You can check with $ dpkg -L samba
user avatar
6 votes

Can A chain of exploits count as a CVE?

would the entire chain of them be eligible for A CVE or would each of the individual one be eligible? Each CVE is intended to represent a single vulnerability. Potential CVEs are more likely to be ...
user avatar
  • 71.7k
6 votes

How Vulnerability scanners assign CVE codes to Vulnerability found

Usually it'll be the other way around, a scanner will have a list of known CVEs and how to test for them. It will then give you a filtered version of that list based on which vunerabilities apply to ...
user avatar
  • 1,086
6 votes
Accepted

Does CVE-2020-0601 (CRYPT32.DLL critical exploit) affect Windows 7 and is there a patch to fix it?

After seeing multiple answers with mixed conclusions here and in Google searches, as well as no thorough explanations on whether or not Windows 7 is effected by this vulnerability, I took it upon ...
user avatar
  • 870
6 votes
Accepted

How can we disable sudo on CentOS 6 to prevent CVE-2021-3156?

How to disable sudo on CentOS 6 to prevent CVE-2021-3156? chmod 0644 /usr/bin/sudo will effectively disable sudo for non-root users. It removes the setguid bit, so sudo will work as epxected for ...
user avatar
  • 12.5k

Only top scored, non community-wiki answers of a minimum length are eligible