32

It depends on how your organization uses these kind of reports. If the people responsible for planning and/or implementing security controls read these documents once and then never look at them again OR see them more as a guideline than actual rules on how to set up an environment, I can see that you might want to refrain from adding too much information ...


10

As a customer of vulnerability reports, I would say yes, but it is certainly a waste of time to give it equal weight as other vulnerabilities. E.g., live, exploitable massive remote access holes or active malicious backdoors wouldn't get the same coverage as something like a DoS vulnerability or in this case a vulnerability in a disabled bit of software. ...


6

Depends on the plugin, they can be if there is say a PHP script that can be called directly (doesn't depend on wordpress code or includes the right statements to load the wordpress libraries it needs). You can effectively attempt to block direct access to the files via htaccess/server configuration but there are ways around that. Removing it entirely is ...


6

First of all you need to have a scope of what you are scanning for and what you are reporting on. For example is the scope of the scanning to discover and report on all vulnerabilities including low risk vulnerabilities, or just high risk one, or maybe just critical vulnerabilities. This should have been defined before you even started the vulnerability ...


6

Usually it'll be the other way around, a scanner will have a list of known CVEs and how to test for them. It will then give you a filtered version of that list based on which vunerabilities apply to the system under test.


5

The Factor Analysis of Information Risk (FAIR), or any Value-at Risk (VaR) model, whether based on MC (Monte Carlo Method), Bayesian statistics, or other sound variable-crunching, model-bound, formulaic risk analysis -- any of these will culminate is a more-efficient risk calculation. If you are a member of ISC2 (e.g., CISSP), you can check out CyVaR by ...


5

There is An ISO dedicated to this subject https://www.iso.org/standard/45170.html It is generally accepted to work with the vendor affected and give them time to resolve the issue within a reasonable time frame. Google project zero takes the stance of 90 days to fix from initial disclosure to the vendor and full disclosure from that point.


5

I cannot find any official statement from Adobe about the problem. But, Flash seems to have bytearrays shared between workers which are similar to SharedArrayBuffer in Javascript and probably can be used for high precision timing. Therefore I think that running Flash content can actually increase the risk of a Meltdown/Spectre attack. Still, given the ...


4

MyCloud is a service that runs on the NAS. The exploits documented on the site you link to allow three different things: 1) Bypass login and pose as a MyCloud administrator 2) Place files anywhere on the NAS 3) Execute commands on the NAS These exploits are limited to the NAS device itself, but as you point out, once an attacker has gained access to the ...


4

Working out the inputs to the calculations is very subjective: Take the CVSSv2: RH: AV:N/AC:M/Au:N/C:P/I:P/A:P NVD: AV:N/AC:L/Au:N/C:C/I:C/A:C Both agree the Attack Vector is Network, and the Authentication is None. But disagree with everything else. NVD think the attack difficulty is easy and the impact is complete. RH think the attack difficulty is ...


3

According the the standard (https://cpe.mitre.org/files/cpe-specification_2.2.pdf), it should mean NA: "It is often necessary to use a CPE Name when identifying a specific release of a given platform. If attempting to create a CPE Name for this, and a specific co mponent is not applicable to the given platform, then the term '-' should be used. Note that ...


3

CVSS tends to be the risk rating model used in nearly all vulnerability reports. One model mentioned in Microsoft's SDL is called DREAD This is primarily used during the threat modelling stage to measure potential risks in software design, however it can be adapted to vulnerabilities too. Here is another useful link on DREAD.


3

No. Numbers would never need to be removed from the database. if they are created and then it appears they were created in error or the vulnerability were a false-positive, they would just be marked 'Rejected' indefinitely - or until proven otherwise. This avoids the possibility of the same vulnerability linking to several CVE numbers for whatever reason. ...


3

You are the vendor, so you make the rules. Just be clear about them. Problem is we only have a limited overall budget and dont want to promise anything we cannot pay. Then be clear about that. It's not uncommon for programs to do challenges/events where they pay special rewards for e.g. the first N critical reports, or pay extra for the best report ...


2

Bandwidth requirements System requirements Training offerings Reporting Accuracy (number of false positives) Time to scan Extra offerings Example: Nessus has web app tool; Nexpose doesn't Vulnerabilities detected (make a vulnerable device have all three scan it)


2

The way that a programming language runtime ensures that concurrent requests that target the same state don't interfere with one another is ultimately through a mechanism called "compare-and-set" which has to be offered by the hardware on which the code is running. "Compare and set" works as follows- two threads say to the hardware- "compare the value of ...


2

Usually the vendor is informed by the person who has found the vulnerability. The vendor is given some time to fix the issue before the vulnerability is disclosed publicly. This is called responsible disclosure. This way, there is already a fix available when the vulnerability gets publicly known.


2

To find out the differences let's look at what these types of management actually do first. Patch Management Patch management includes the planning, acquiring, testing and installing of changes to a software. This can be any kind of software: operating systems, drivers, application software or firmware on appliances. A patch is not necessarily installed to ...


2

If someone makes a buying decision, they might say "this router supports DNS resolution in the router. We don't use this now, but we might do so in the future, so we buy this router and not a slightly cheaper one without the feature". That vulnerability means the router cannot be used that way, so the feature mustn't be used for the buying decision. In ...


2

Unfortunately, CVSS ratings are always more individual than desired. See my question CVSS Score Remote or Local Scenario for an example of such a discussion. I am responsible for the CVSS rating on VulDB.com and we face similar problems like NVD. In some cases the exact details are not known which would lead to partial vectors. And partial vectors can't be ...


2

This is a risk assessment and threat modelling style question - rather than a hard yes or no. Do you want to accept the risk of not patching the service, which could be exploited in the future - may be someone runs it later on. Or do you not accept the risk of updating your OS/software which could cause adverse affects on running services. Only your ...


2

Yes, it's possible and there are known attacks based on svchost.exe file/service. Windows processes are essential for usual operation of OS. Some processes require special privileges or resources, which a regular user may not have. This is exactly what malware writers are looking for. The following are processes commonly used by malwares (Source : https://...


2

So what does OpenVAS actually do? It fingerprints your server, does discovery scans, mappings etc. and then compares your system with an exploit database, identifying all vulnerabilities that are most likely affecting your system. All these steps can be done by a human in a manual way. You can, for example perform an nmap scan on your server, grab the ...


2

Quantifying the time to remediate is a function of the assessed risk. Risk is a function of impact and likelihood of the impact occurring. That's the general recommendation, and the organisation needs to work that out for itself. A corporate policy helps define the default time for remedies to be applied based on the organisation's risk tolerance and the ...


2

Let's take your Node.js example. You are using a version of with a known vulnerability. Therefore you have two options: Stay on the version that you know is vulnerable Upgrade to a version that may be vulnerable. The only correct choice is #2. Is it possible that you are upgrading to a version that also has vulnerabilities? Absolutely! In fact that is ...


2

For me, any of the above recommendations is a change that needs to be applied to a given application, host, etc. Totally agree on that point, and if you have a Change Management Process, all those changes should pass through it. how can one make sure that any of the changes does not lead to reduced or compromised security? How one can make sure that the ...


2

I think you are asking the wrong question. Consider the following: If you fix fewer vulnerabilities than emerge between scans, then the number of vulnerabilities will only go up (10 vulns - 3 fixes + 4 new vulns = 11) If you do not fix all vulnerabilities, you will never get to 0 Scans can have false positives that you need to verify Some vulnerabilities ...


1

The emulation features within a browser emulate they way in which the DOM is interpreted (in a nutshell how the page should be displayed and respond). Vulnerabilities within a browser do not carry across to the emulation (unless the vulnerability exists within the host browser as well). Therefore in your example, if the emulator itself has a bug, even if ...


1

I think the CWE is just not the right place. Quote from the FAQ: A1. What is CWE? What is a "software weakness"? Targeted at both the development community and the community of security practitioners, Common Weakness Enumeration (CWE™) is a formal list or dictionary of common software weaknesses that can occur in software's architecture, design, ...


1

I think it's worse than just switching the cloud parts off -- some of the vulnerabilities (just set a cookie to be classed as logged in, trust the supplied data for uploading a manual firmware update) I think mean visiting a malicious website could request the MyCloud to upload and install an update of the attacker's choosing. It might be the firewall would ...


Only top voted, non community-wiki answers of a minimum length are eligible