Hot answers tagged

66

You can do either, but I recommend applying for a CVE so that customers who get threat intelligence feeds are more likely to notice the issue and expedite a patch. Assigning a CVE also makes it easier to reference a specific vulnerability in general communications if you need to later. It's also a signal to your customers that you take security transparency ...


23

It would be helpful to publish the CVE so that others know it's necessary to update: as you said, they can see it in threat intelligence feeds (or CVE scans) instead of having to read the changelog of every update to decide whether they need to update. Additionally, as a pentester, it helps us a lot in our work. If we find SAPConnectorDeluxe 4.1.39, the ...


10

Until 2016, MITRE was having trouble assigning CVEs. The process was cumbersome, it took a very long time, and more often than not, researchers simply didn't get a CVE assigned. In 2017, MITRE changed their assignment process. They created a web form, and are now assigning CVEs in a matter of hours or days. They also outsourced the assignment of CVEs for ...


8

You are not required to request a CVE, but you are free to do so when you think it will be benificial. A CVE is just a central number that identifies a vulnerability, which can assist when communicating about vulnerabilities. CVE's are particularly helpful when there are multiple parties involved. Anyone can request a CVE in your product, but in my opinion ...


6

I think the most important question is if your product comes with an auto-updater. If it auto-updates by default, then a CVE can sometimes do more harm than good by putting your product into the realm of awareness for many hackers who may otherwise not know you even exist. They can see your CVE history, and get a good feeling about your security posture. ...


4

CNAs can take more than a week to respond. Some are staffed by a small team - sometimes just one person - and if people are on holiday or off sick then there may be delays. If two weeks goes by and you've got nothing back, that's more of a cause for concern. If you feel like an excessive amount of time has passed you can opt to ask MITRE for a CVE directly ...


4

When someone discovers a vulnerability, they can request a Common Vulnerabilities and Exposures (CVE) id. This id will be linked to the vulnerability and is linked to you as a person. Whether it is used on a resume is totally up to you, I personally started doing this recently in order to show my activities.


3

Getting a victim to open a file is a proven effective way to attack an organisation - phishing and social engineering work, very well. So assume that part of the attack is low effort if you or your organisation is a target. As regards anything that sounds like complex crafting of a payload, if it can be created it will. The market in attacks flows down from ...


3

You can use the CVE API that Red Hat maintains. It has a lot of options to search for a vulnerability given a CVE or other parameters, you can even run a search by components with a range of dates (before and after filters). An example of the query that you may be interested in, will be something like this: https://access.redhat.com/labs/securitydataapi/...


3

No. Numbers would never need to be removed from the database. if they are created and then it appears they were created in error or the vulnerability were a false-positive, they would just be marked 'Rejected' indefinitely - or until proven otherwise. This avoids the possibility of the same vulnerability linking to several CVE numbers for whatever reason. ...


3

CVE is not going to provide that level of information, as you probably saw. CVSS, on the other hand, does. CVE often links to the NVD, which uses CVSS scoring, so it might be an easy mistake to make. Many information security people confuse "risk" with "impact". So, if we assume that they meant "impact and probability are based on CVSS", then everything ...


3

Classes of Java Applet vulnerability Vulnerabilities in the Applets themselves This would include issues with how the applet is written, such as: Backdoors Cross Site Scripting Cross Site Request Forgery Vulnerabilities in the Browser and JRE This would include issues with allowing the running of Java applets, such as: Ability to track users Ability to ...


2

Not really. I mean, in theory you could, but it's absurdly unlikely that anyone will. Go is a relatively safe language, so vulns in Go code tend to be logic errors, not mechanical ones. This means that vulnerabilities are marked not by patterns in the binary, but attributes of the control flow. Essentially for detecting a given CVE you'd have to construct ...


2

If this is a really critical issue, then you might patch the issue and keep it secret for as long as possible. Then the customers have a longer time frame for applying software updates. Also make sure to use as much binary obfuscation as possible, in order to hinder "differential reverse engineering" after delivering the patch.


2

The answer lies on this page: https://github.com/nixawk/labs/tree/master/CVE-2018-10562 An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /...


1

Few companies will apply patches immediately, most will have some quality control and evaluation before any update is put into their systems. The CVE definition allows them to know what vulnerabilities are in the current version of the software. Then can then evaluate that vulnerability and make an informed choice of when they will apply the update.


1

We found https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt which has a few patches in the mitigation section. I used these against a fresh download of openssh-7.9p1. I had to do a minor edit to scp.c around hunk #9 for the patch as it looked like a partial hunk of this patch was already in place. I also had to ignore whitespace. wget ...


1

This CVE is not fixed in OpenJDK7. Both Debian and redhat report it as unfixed: https://security-tracker.debian.org/tracker/CVE-2012-5373: unfixed https://access.redhat.com/security/cve/cve-2012-5373: Will not fix


1

I think they actually meant risk and probability, and not impact and probability, because in the article we have several formulas to calculate impact.


1

I sent a support request to Netsparker and they responded with the following: First, they try to retrieve the library name and version number out of the code comments, If that doesn't work, they checks if there is version() (or similar) function. They mentioned for some libraries the file hash / checksum is used to detect the version. Also, for multiple ...


1

There are a few of ways to do the check: Parse the version information. Hash the JS file and check it against a known list of software versions. Build a database of pattern checks that identify software and its version. Option 3 would detect old JS embedded inside a combined file. I don't know which of these Netsparker actually uses, but you could ask ...


1

NIST and MITRE are always good places to check for vulnerabilities. They both have pretty robust search functionalities: NIST search for "microsoft windows" MITRE search for "microsoft windows" Take a look. These might give some of the information you're looking for. If not, is there a specific feature or product within Windows that you're wondering about?


1

This is available in Microsoft's Security Advisories and Bulletins from MSRC: In this library you will find the following security documents that have been released by the Microsoft Security Response Center (MSRC). The MSRC investigates all reports of security vulnerabilities affecting Microsoft products and services, and releases these documents as part ...


1

Is this a limited vulnerability? It is limited in the sense that the vulnerability can only apply if your application is querying via $.get an untrusty/compromised website. What could be its possible effects? As per the CVE, your application would be vulnerable to XSS and all of its implications. Should it be treated dangerous? As much as any XSS ...


1

I understand that you want some vulnerability scanning/auditing that is capable to find vulnerabilities on Go executables by inspecting it. I already read some articles that fit on keywords such as "golang vulnerable function" expecting to encountering some lack of security functions alike in C language that fight against stack overflow (i.g., strcpy, gets, ...


1

Quoting directly from the IME firwmare update notes, if the attacker does not have physical access to the plaform to do a firmware flash, then they cannot do anything if the recommended flash descriptor write protections have been enabled. If they haven't, then the attackers needs ring 0 access to the kernel, where an attacker can exploit the ...


Only top voted, non community-wiki answers of a minimum length are eligible