4 ms·

CVSS scores range from 0.0 to 10.0 so this one, at 10.0, is "as bad as it gets". The advisory says: > The Cisco Product Security Incident Response Team (PSIRT

CVSS scores range from 0.0 to 10.0 so this one, at 10.0, is "as bad as it gets". The advisory says: > The Cisco Product Security Incident Response Team (PSIRT) is aware of public knowledge of the vulnerability that is described in this advisory. Cisco PSIRT is not aware of any malicious use of the vulnerability described in this advisory. ... though I'm guessing that will change in the very near future. Time to go reconfigure and/or update some firewalls...

tptacek 9y ago
CVSS scores are like Ouija boards; you can make them say whatever you want them to say. I wouldn't take them too seriously. That's not to say that this isn't a severe vulnerability, but rather that plenty of vulnerabilities that don't get a "10.0" are just as bad. The pragmatic, conservative way to look at these kinds of announcements is: * Assume any vulnerability that refers to memory corruption (really, "memory" of any sort not qualified by "reading", which is itself a pretty bad vulnerability) is remote code execution. * Assume potential remote code execution is remote code execution. * Assume remote code execution or denial of service is remote code execution. * If the announcement doesn't clearly indicate that the vulnerability requires authentication to exploit, assume it's pre-auth.
- jlgaddis 9y ago
  If you have an ASA, WebVPN is enabled, OOTB. If you have an ASA that hasn't been updated today, you are vulnerable to DoS and RCE vulnerabilities. That is, as far as I'm concerned, about as bad as it gets (we've got, I dunno, several dozen of these). I realize that, like everything, CVSS scores aren't perfect. But as a general "how bad is this?" indicator, I do think it's useful and, in this case, the 10.0 does the job of pointing out, "It's bad".
  - tptacek 9y ago
    Right, I'm less perturbed by the 10.0 these bugs got, and more by the huge number that get lower scores. I don't think CVSS works.

tptacek 9y ago

CVSS scores are like Ouija boards; you can make them say whatever you want them to say. I wouldn't take them too seriously. That's not to say that this isn't a severe vulnerability, but rather that plenty of vulnerabilities that don't get a "10.0" are just as bad. The pragmatic, conservative way to look at these kinds of announcements is: * Assume any vulnerability that refers to memory corruption (really, "memory" of any sort not qualified by "reading", which is itself a pretty bad vulnerability) is remote code execution. * Assume potential remote code execution is remote code execution. * Assume remote code execution or denial of service is remote code execution. * If the announcement doesn't clearly indicate that the vulnerability requires authentication to exploit, assume it's pre-auth.

jlgaddis 9y ago
If you have an ASA, WebVPN is enabled, OOTB. If you have an ASA that hasn't been updated today, you are vulnerable to DoS and RCE vulnerabilities. That is, as far as I'm concerned, about as bad as it gets (we've got, I dunno, several dozen of these). I realize that, like everything, CVSS scores aren't perfect. But as a general "how bad is this?" indicator, I do think it's useful and, in this case, the 10.0 does the job of pointing out, "It's bad".
- tptacek 9y ago
  Right, I'm less perturbed by the 10.0 these bugs got, and more by the huge number that get lower scores. I don't think CVSS works.