Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 27 Jun 2014 16:03:43 -0400 (EDT)
Subject: Re: Question regarding CVE applicability of missing HttpOnly flag

Hash: SHA1

> I suppose maybe there is a CWE for not having a virus scanner, which
> makes sense as that could be considered an overall system weakness.

Neither CVE nor CWE attempts to cover the general topic of system
integration, i.e., questions such as "given the composition and role
of this entire system, is it unreasonable to omit a virus scanner?" In
practice, both CVE and CWE often tend to be about questions that may
come up when considering somewhere around one line of code or one file
of code. (This is just an observational statement, not an attempt to
redefine why CVE and CWE exist.) Typical audiences may include (among
others) developers who need to write a line of code safely or system
administrators who need to patch a faulty line of code.

This doesn't mean that there's any objection to someone taking the
position that lack of a virus scanner is the most serious security
concern that they see in an entire system. This is a valid perspective
but is outside of the problem spaces in which CVE and CWE have been
operating. Even if everyone were looking at "whether or not a flaw is
a flaw" decisions in precisely the same way, a conclusion of "yes,
this system would really benefit from a virus scanner" leaves open the
question of the best place to capture that information.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through ]
Version: GnuPG v1.4.14 (SunOS)


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.