再保险:CNA规则公告

在星期一,2016年10月10日,梦露,布鲁斯写道::这是一个很好的例子,我们就遇到了内部。如何:对非挂牌服务路径?::https://web.nvd.nist.gov/view/vuln/search-results?query=unquoted +搜索+ path&search_type = all&cves =::正如你所看到的从供应商分配他们的搜索结果:自己的。我们最近发现了一个内部做同样的的决定:但这是有效相同的漏洞重复很多:软件。更因为大多数非上市搜索路径的特权升级问题不是一个弱点。通常他们需要某种形式的管理访问执行“攻击”,他们并不是真正跨越特权边界。:挑战:::——人们分配CVE的必须分配另一个CVE之前。不确定会发生……斜方通常是好这样做,但他们被限制,因为他们看不到作业区域,还没有公开。此外,如果他们是在监视CNA的披露,他们可能欺骗分配由于各种各样的竞态条件。:-清单最终会成长是巨大的,我希望这将是:挖掘有点痛…这个目前有3页的cf:,)VulnDB有61项“非上市搜索路径”的标题,没有CVE 34。 Based on the CVSS scores, only 1 of them was considered valid. : Agree we should be consistent in our approach, if we could come up with : a simple, solid, easily repeatable way to reference a master CVE and : pile on with "like" issues I'd be in favor of that approach, as long as : it could be done without losing visibility of each sub-entry. The 'easiest' way (said externally, knowing it is a lot more work for MITRE) is to reference the other CVEs in the entry as someone previous mentioned. They already do it for duplicate assignments (e.g. REJECTED see CVE-1234-5678". They could carry this on as "MASTER see IDs 1,2,3,4,5 for similar issues" in better language. Brian