Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 14 Jul 2017 07:58:37 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com, Steven Miano <mianosm@...il.com>
Subject: Re: Estimate for the total number of exploitable bugs
 in large linux distro?

On 07/14/17 02:45 AM, Steven Miano wrote:
> Something like this?
> 
> https://www.cvedetails.com/vendor/51/Ubuntu.html
> https://www.cvedetails.com/vendor/7838/Red-Hat.html
> https://www.cvedetails.com/vendor/26/Microsoft.html

Those are known vulnerabilities, with varying degrees of exploitability,
and varying exploit conditions and sometimes differing views on where to
draw the line on what is one issue or multiple issues.

Some of them can be remotely exploited, some require a local user to take
action.  Some give access to those who had none, some give higher privs to
those who had some, and some don't change your access levels at all.

Of course, they don't count all the ones that haven't been publicly
disclosed - either because they are unknown or only known to certain people.

And when you start comparing numbers with Linux distros things get even
messier - if you include the count of every issue in every package in
their package repositories then you are including a far larger set of
software than if you just count what's in others OS - but that doesn't
mean they are more or less secure, just that they have more or less
software available for easy installation.

For a far more complete answer of why vulnerability counting is messy,
hard, and just plain sucks, you can turn to the experts:

https://media.blackhat.com/us-13/US-13-Martin-Buying-Into-The-Bias-Why-Vulnerability-Statistics-Suck-WP.pdf
https://media.blackhat.com/us-13/US-13-Martin-Buying-Into-The-Bias-Why-Vulnerability-Statistics-Suck-Slides.pdf

-- 
	-Alan Coopersmith-               alan.coopersmith@...cle.com
	 Oracle Solaris Engineering - https://blogs.oracle.com/alanc

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.