32

It depends on how your organization uses these kind of reports. If the people responsible for planning and/or implementing security controls read these documents once and then never look at them again OR see them more as a guideline than actual rules on how to set up an environment, I can see that you might want to refrain from adding too much information ...


10

As a customer of vulnerability reports, I would say yes, but it is certainly a waste of time to give it equal weight as other vulnerabilities. E.g., live, exploitable massive remote access holes or active malicious backdoors wouldn't get the same coverage as something like a DoS vulnerability or in this case a vulnerability in a disabled bit of software. ...


6

Depends on the plugin, they can be if there is say a PHP script that can be called directly (doesn't depend on wordpress code or includes the right statements to load the wordpress libraries it needs). You can effectively attempt to block direct access to the files via htaccess/server configuration but there are ways around that. Removing it entirely is ...


6

First of all you need to have a scope of what you are scanning for and what you are reporting on. For example is the scope of the scanning to discover and report on all vulnerabilities including low risk vulnerabilities, or just high risk one, or maybe just critical vulnerabilities. This should have been defined before you even started the vulnerability ...


5

There is An ISO dedicated to this subject https://www.iso.org/standard/45170.html It is generally accepted to work with the vendor affected and give them time to resolve the issue within a reasonable time frame. Google project zero takes the stance of 90 days to fix from initial disclosure to the vendor and full disclosure from that point.


5

I cannot find any official statement from Adobe about the problem. But, Flash seems to have bytearrays shared between workers which are similar to SharedArrayBuffer in Javascript and probably can be used for high precision timing. Therefore I think that running Flash content can actually increase the risk of a Meltdown/Spectre attack. Still, given the ...


4

The Factor Analysis of Information Risk (FAIR), or any Value-at Risk (VaR) model, whether based on MC (Monte Carlo Method), Bayesian statistics, or other sound variable-crunching, model-bound, formulaic risk analysis -- any of these will culminate is a more-efficient risk calculation. If you are a member of ISC2 (e.g., CISSP), you can check out CyVaR by ...


4

MyCloud is a service that runs on the NAS. The exploits documented on the site you link to allow three different things: 1) Bypass login and pose as a MyCloud administrator 2) Place files anywhere on the NAS 3) Execute commands on the NAS These exploits are limited to the NAS device itself, but as you point out, once an attacker has gained access to the ...


4

Working out the inputs to the calculations is very subjective: Take the CVSSv2: RH: AV:N/AC:M/Au:N/C:P/I:P/A:P NVD: AV:N/AC:L/Au:N/C:C/I:C/A:C Both agree the Attack Vector is Network, and the Authentication is None. But disagree with everything else. NVD think the attack difficulty is easy and the impact is complete. RH think the attack difficulty is ...


3

According the the standard (https://cpe.mitre.org/files/cpe-specification_2.2.pdf), it should mean NA: "It is often necessary to use a CPE Name when identifying a specific release of a given platform. If attempting to create a CPE Name for this, and a specific co mponent is not applicable to the given platform, then the term '-' should be used. Note that ...


3

CVSS tends to be the risk rating model used in nearly all vulnerability reports. One model mentioned in Microsoft's SDL is called DREAD This is primarily used during the threat modelling stage to measure potential risks in software design, however it can be adapted to vulnerabilities too. Here is another useful link on DREAD.


3

No. Numbers would never need to be removed from the database. if they are created and then it appears they were created in error or the vulnerability were a false-positive, they would just be marked 'Rejected' indefinitely - or until proven otherwise. This avoids the possibility of the same vulnerability linking to several CVE numbers for whatever reason. ...


2

Bandwidth requirements System requirements Training offerings Reporting Accuracy (number of false positives) Time to scan Extra offerings Example: Nessus has web app tool; Nexpose doesn't Vulnerabilities detected (make a vulnerable device have all three scan it)


2

The way that a programming language runtime ensures that concurrent requests that target the same state don't interfere with one another is ultimately through a mechanism called "compare-and-set" which has to be offered by the hardware on which the code is running. "Compare and set" works as follows- two threads say to the hardware- "compare the value of ...


2

Usually the vendor is informed by the person who has found the vulnerability. The vendor is given some time to fix the issue before the vulnerability is disclosed publicly. This is called responsible disclosure. This way, there is already a fix available when the vulnerability gets publicly known.


2

To find out the differences let's look at what these types of management actually do first. Patch Management Patch management includes the planning, acquiring, testing and installing of changes to a software. This can be any kind of software: operating systems, drivers, application software or firmware on appliances. A patch is not necessarily installed to ...


2

If someone makes a buying decision, they might say "this router supports DNS resolution in the router. We don't use this now, but we might do so in the future, so we buy this router and not a slightly cheaper one without the feature". That vulnerability means the router cannot be used that way, so the feature mustn't be used for the buying decision. In ...


2

Unfortunately, CVSS ratings are always more individual than desired. See my question CVSS Score Remote or Local Scenario for an example of such a discussion. I am responsible for the CVSS rating on VulDB.com and we face similar problems like NVD. In some cases the exact details are not known which would lead to partial vectors. And partial vectors can't be ...


2

This is a risk assessment and threat modelling style question - rather than a hard yes or no. Do you want to accept the risk of not patching the service, which could be exploited in the future - may be someone runs it later on. Or do you not accept the risk of updating your OS/software which could cause adverse affects on running services. Only your ...


2

So what does OpenVAS actually do? It fingerprints your server, does discovery scans, mappings etc. and then compares your system with an exploit database, identifying all vulnerabilities that are most likely affecting your system. All these steps can be done by a human in a manual way. You can, for example perform an nmap scan on your server, grab the ...


1

The emulation features within a browser emulate they way in which the DOM is interpreted (in a nutshell how the page should be displayed and respond). Vulnerabilities within a browser do not carry across to the emulation (unless the vulnerability exists within the host browser as well). Therefore in your example, if the emulator itself has a bug, even if ...


1

I think the CWE is just not the right place. Quote from the FAQ: A1. What is CWE? What is a "software weakness"? Targeted at both the development community and the community of security practitioners, Common Weakness Enumeration (CWE™) is a formal list or dictionary of common software weaknesses that can occur in software's architecture, design, ...


1

I think it's worse than just switching the cloud parts off -- some of the vulnerabilities (just set a cookie to be classed as logged in, trust the supplied data for uploading a manual firmware update) I think mean visiting a malicious website could request the MyCloud to upload and install an update of the attacker's choosing. It might be the firewall would ...


1

For bugs in Google Chrome there is the Chromium issue tracker. Security bugs are submitted and resolved over this system just like normal bugs. The difference is that they are flagged with special security labels outlined here. For example, the label Restrict-View-SecurityTeam will keep a bug secret between the reporter and the Chromium security team. is ...


1

You should interpret it as such, an untrusted input is able to write to section in memory that it isn't supposed to write because application fails to check its size. I think you are in the mindset of always categorising RCE as extension of buffer overflow when they could be different issues altogether. Take for instance RCE due to remote file inclusion, or ...


1

This is primarily a business decision. There are two extremes: Accept the risk - just carry on and hope no hackers exploit this. Turn off the application - no chance to it being hacked if it's turned off. In practice, the risk of XSS on an internal network is pretty low. If external attackers are on the network, they can probably do worse things. Malicious ...


1

Mitigating the risk of having a scanning system with credentials in the environment can be accomplished with the following best practices: Use a dedicated system for scanning and disable it (disable NIC / power it off) when not in use. Use dedicated credentials (AD preferably or local if necessary) for the scanner and disable them when not in use. Rotate ...


1

I have gotten CVE entries corrected previously, but not consistently. I think it depends on how much they have to do to verify in what you tell them. If you can show internal inconsistencies (e.g. the description says these versions are affected, but the list of affected versions is different) I've had them correct that. For more involved things they say ...


1

CVSS is very popular. Many organizations use CVSS, like Acunetix and IBM App Scan. Though Web Inspect and Burp Suite which are also web app scanner use the experience of their researchers to assign severity to a finding. CVSS v3 is a far improvement over CVSS v2 and is better suited for web application vulnerabilities.


1

There is also CWSS. The documentation also describes the differences with CVSS: CVSS assumes that a vulnerability has already been discovered and verified; CWSS can be applied earlier in the process, before any vulnerabilities have been proven. CVSS scoring does not account for incomplete information, but CWSS scoring has built-in support for ...


Only top voted, non community-wiki answers of a minimum length are eligible