Date: Mon, 21 Jan 2013 18:31:02 -0700 From: Kurt Seifried <kseifried@...hat.com> To: oss-security@...ts.openwall.com CC: Eitan Adler <lists@...anadler.com> Subject: Re: Whats worth a CVE? -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 01/21/2013 02:17 PM, Eitan Adler wrote: > On 21 January 2013 14:50, Scott Herbert > <scott.a.herbert@...glemail.com> wrote: >> Well the subject sum's the question up really, are their any >> fixed guidelines for what counts as a CVE and what doesn't? Or is >> it just up to the CVE pool manager as to what they feel is of >> note? > > CVEs are given to vulnerabilities. A detailed explanation of what > these are can be found here: > https://cve.mitre.org/about/terminology.html > > Further note, for example: A default account/password in a device or service. Is this a security issue or not? Different scenarios have different outcomes: 1) The default account/password is well documented. The services forces you to change the password when first run and will refuse to run until you do change the password. Generally not considered a vuln. 2) The default account/password is well documented. The services does not force you to change the password when first run. Generally not considered a vuln as it falls into the "don't do stupid things" class of issues. 3) The default account/password is not well documented or not documented at all but can be changed. Generally this would be considered a vulnerability. 4) The default account/password is not well documented or not documented at all and can NOT be changed. Generally this would be considered a vulnerability. Similar things for other things, is it a security vulnerability or security hardening, or not a security issue at all? It definitely gets fuzzy/messy sometimes. - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQIcBAEBAgAGBQJQ/evWAAoJEBYNRVNeJnmTQOgP/3E8ssvj1W3tLrgwmd8XXsaD 2U4V6ZueEr0CyIxqlHXHDXBWgtXp2/LYt1ZQg6TkWALIUaj8kuptUd/DLO37+A2b bNEcpYXkTuRUgOqf80wXZJ7a6kxUiLCRHh1nIFsqLiiJ/LUG06M2bhJWoFeDVg7f BUM087WJeCGqsNyUAz21UKlqoGhuhELP0Uom7bmKy2P2q0btYqdQCI9Tlst0QP+3 GsoMfUTSa5Ep8E3r7vIGwP6hYA8n/TLrB1Ze95f3ttsqEfWBdXfMYN01SYYw/khn aaSvPFK3oHwvb3gc/2fE9sTq8dgoSPKBh09jqbvVPw/NaOiipbOnIMk9eCNL0iNl 0mHfD9hsS9h1XFiQmZbtmkPWQCjXIlL42llRjJgYAxGnm8QIH3LWqcJdrOALpCGa mawi39ItKsQuvLLPr8Jp7LoyeiFRBUKNMLO/QEGWG8rb7sleR3n+VifBqxenNZPP PJTWW1F5mm1vtB2+zLbz0tfR+7YS0t4j7iSrzg50veVum5Mn/kc+zh41Nvtr5yvd 9F37Yfg1AMsoWEnw4ceT5SJs+UBsKQagD9E3EZPXc8W58l6bnTvJWbx4G7Cmsc9h JHUOF0sQGofKiFPTmY8jYXLoGoN5pYwHB/xyosdo9Pm1MgjUASK05tfTc/cemK7e BIo4RQ3BMeW7T/HlYZaz =50LH -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.