56

They don't. By releasing code, they automatically "disclose" the issue to those who can reverse engineer the patch. But they can delay explaining or providing the details for easy consumption. If they delay releasing the code, they force users to use known-vulnerable code. If they release the code and do not announce it as a security fix, then ...


32

It depends on how your organization uses these kind of reports. If the people responsible for planning and/or implementing security controls read these documents once and then never look at them again OR see them more as a guideline than actual rules on how to set up an environment, I can see that you might want to refrain from adding too much information ...


20

The same way they prevent disclosing the report: by not disclosing it. Since you mentioned the Linux kernel specifically: only a vanishingly small number of users build their kernels directly from the master branch of Linus Torvald's Git repository. The vast majority of users simply use whatever kernel their distribution's automatic updater installs. In turn,...


17

Coincidentally I have a tab open about CVE-2020-17640 in the Eclipse Vert.x project where the product maintainers are discussing this exact issue! Julien Viet 2020-09-28 13:07:31 EDT So I just need to provide the details of the CVE to get one ? If that is so, I don't get how that can remain confidential until we publish a fix. Wayne Beaton 2020-09-28 23:03:...


10

As a customer of vulnerability reports, I would say yes, but it is certainly a waste of time to give it equal weight as other vulnerabilities. E.g., live, exploitable massive remote access holes or active malicious backdoors wouldn't get the same coverage as something like a DoS vulnerability or in this case a vulnerability in a disabled bit of software. ...


6

Depends on the plugin, they can be if there is say a PHP script that can be called directly (doesn't depend on wordpress code or includes the right statements to load the wordpress libraries it needs). You can effectively attempt to block direct access to the files via htaccess/server configuration but there are ways around that. Removing it entirely is ...


6

First of all you need to have a scope of what you are scanning for and what you are reporting on. For example is the scope of the scanning to discover and report on all vulnerabilities including low risk vulnerabilities, or just high risk one, or maybe just critical vulnerabilities. This should have been defined before you even started the vulnerability ...


6

Usually it'll be the other way around, a scanner will have a list of known CVEs and how to test for them. It will then give you a filtered version of that list based on which vunerabilities apply to the system under test.


5

There is An ISO dedicated to this subject https://www.iso.org/standard/45170.html It is generally accepted to work with the vendor affected and give them time to resolve the issue within a reasonable time frame. Google project zero takes the stance of 90 days to fix from initial disclosure to the vendor and full disclosure from that point.


5

The Factor Analysis of Information Risk (FAIR), or any Value-at Risk (VaR) model, whether based on MC (Monte Carlo Method), Bayesian statistics, or other sound variable-crunching, model-bound, formulaic risk analysis -- any of these will culminate is a more-efficient risk calculation. If you are a member of ISC2 (e.g., CISSP), you can check out CyVaR by ...


5

I cannot find any official statement from Adobe about the problem. But, Flash seems to have bytearrays shared between workers which are similar to SharedArrayBuffer in Javascript and probably can be used for high precision timing. Therefore I think that running Flash content can actually increase the risk of a Meltdown/Spectre attack. Still, given the ...


4

MyCloud is a service that runs on the NAS. The exploits documented on the site you link to allow three different things: 1) Bypass login and pose as a MyCloud administrator 2) Place files anywhere on the NAS 3) Execute commands on the NAS These exploits are limited to the NAS device itself, but as you point out, once an attacker has gained access to the ...


4

According the the standard (https://cpe.mitre.org/files/cpe-specification_2.2.pdf), it should mean NA: "It is often necessary to use a CPE Name when identifying a specific release of a given platform. If attempting to create a CPE Name for this, and a specific co mponent is not applicable to the given platform, then the term '-' should be used. Note that ...


4

Working out the inputs to the calculations is very subjective: Take the CVSSv2: RH: AV:N/AC:M/Au:N/C:P/I:P/A:P NVD: AV:N/AC:L/Au:N/C:C/I:C/A:C Both agree the Attack Vector is Network, and the Authentication is None. But disagree with everything else. NVD think the attack difficulty is easy and the impact is complete. RH think the attack difficulty is ...


4

This entire thing boils down to one simple concept: risk management. You have a piece of software that gives you raw information about potential threats. Now you go through the process you outlined: Identifying vulnerabilities Evaluating vulnerabilities Treating vulnerabilities Reporting vulnerabilities False positives: you evaluate the identified ...


4

Yes, it is important to fix vulnerabilities inside a corporate environment, even if these hosts are not internet-facing. Why? Because if the endpoint is used by an employee, it can be compromised via phishing, malware, breached VPN access or similar means. This means your idea of a "safe environment" doesn't hold up to reality. If your security is ...


3

Yes. There is now the Hardware Design CWE View. It lists CWEs such as: CWE-1247: Missing or Improperly Implemented Protection Against Voltage and Clock Glitches CWE-1248: Semiconductor Defects in Hardware Logic with Security-Sensitive Implications CWE-1232: Improper Lock Behavior After Power State Transition CWE-1245: Improper Finite State Machines (FSMs) ...


3

CVSS tends to be the risk rating model used in nearly all vulnerability reports. One model mentioned in Microsoft's SDL is called DREAD This is primarily used during the threat modelling stage to measure potential risks in software design, however it can be adapted to vulnerabilities too. Here is another useful link on DREAD.


3

No. Numbers would never need to be removed from the database. if they are created and then it appears they were created in error or the vulnerability were a false-positive, they would just be marked 'Rejected' indefinitely - or until proven otherwise. This avoids the possibility of the same vulnerability linking to several CVE numbers for whatever reason. ...


3

You are the vendor, so you make the rules. Just be clear about them. Problem is we only have a limited overall budget and dont want to promise anything we cannot pay. Then be clear about that. It's not uncommon for programs to do challenges/events where they pay special rewards for e.g. the first N critical reports, or pay extra for the best report ...


2

Bandwidth requirements System requirements Training offerings Reporting Accuracy (number of false positives) Time to scan Extra offerings Example: Nessus has web app tool; Nexpose doesn't Vulnerabilities detected (make a vulnerable device have all three scan it)


2

The way that a programming language runtime ensures that concurrent requests that target the same state don't interfere with one another is ultimately through a mechanism called "compare-and-set" which has to be offered by the hardware on which the code is running. "Compare and set" works as follows- two threads say to the hardware- "compare the value of ...


2

To find out the differences let's look at what these types of management actually do first. Patch Management Patch management includes the planning, acquiring, testing and installing of changes to a software. This can be any kind of software: operating systems, drivers, application software or firmware on appliances. A patch is not necessarily installed to ...


2

If someone makes a buying decision, they might say "this router supports DNS resolution in the router. We don't use this now, but we might do so in the future, so we buy this router and not a slightly cheaper one without the feature". That vulnerability means the router cannot be used that way, so the feature mustn't be used for the buying decision. In ...


2

Unfortunately, CVSS ratings are always more individual than desired. See my question CVSS Score Remote or Local Scenario for an example of such a discussion. I am responsible for the CVSS rating on VulDB.com and we face similar problems like NVD. In some cases the exact details are not known which would lead to partial vectors. And partial vectors can't be ...


2

This is a risk assessment and threat modelling style question - rather than a hard yes or no. Do you want to accept the risk of not patching the service, which could be exploited in the future - may be someone runs it later on. Or do you not accept the risk of updating your OS/software which could cause adverse affects on running services. Only your ...


2

Yes, it's possible and there are known attacks based on svchost.exe file/service. Windows processes are essential for usual operation of OS. Some processes require special privileges or resources, which a regular user may not have. This is exactly what malware writers are looking for. The following are processes commonly used by malwares (Source : https://...


2

So what does OpenVAS actually do? It fingerprints your server, does discovery scans, mappings etc. and then compares your system with an exploit database, identifying all vulnerabilities that are most likely affecting your system. All these steps can be done by a human in a manual way. You can, for example perform an nmap scan on your server, grab the ...


2

Quantifying the time to remediate is a function of the assessed risk. Risk is a function of impact and likelihood of the impact occurring. That's the general recommendation, and the organisation needs to work that out for itself. A corporate policy helps define the default time for remedies to be applied based on the organisation's risk tolerance and the ...


2

Let's take your Node.js example. You are using a version of with a known vulnerability. Therefore you have two options: Stay on the version that you know is vulnerable Upgrade to a version that may be vulnerable. The only correct choice is #2. Is it possible that you are upgrading to a version that also has vulnerabilities? Absolutely! In fact that is ...


Only top voted, non community-wiki answers of a minimum length are eligible