4 ms·

In general, I'm not a fan of vulnerability quantification efforts like CVSS. The reason is that they provide the appearance of repeatability and objectivity wh

• geofft 7y ago
  In 2009 some classmates and I wrote a paper called "Security Impact Ratings Considered Harmful": https://arxiv.org/pdf/0904.4058.pdf https://arxiv.org/pdf/0904.4058.pdf The position is that using CVSS to decide which updates to take is a losing gamble. You don't have a good idea in advance of how easily something is exploitable, and trusting the CVSS scorers to say "oh, this particular out-of-bounds write causes a crash but isn't exploitable to run arbitrary code" is misplaced: they're not exploit developers and they're not spending time trying to build an exploit chain. If you have a process for doing software updates, do them unconditionally, on schedule, and promptly, for all security updates and if possible all updates period. Don't "prioritize" the way this article and CVSS aa a whole encourages you to. Upstream developers are working and looking at the master branch only, and if a certain component got rewritten, it's entirely possible there's no white-hat attention on the old version ever again. And if you don't have a process—i.e., if you treat CVSS over 9 as a sign you should run around in a panic and figure out something ad hoc, and not care otherwise—the absolute best thing you can do for your security is to fix that. In the course of writing the paper, we ran 'git log' on a recent Linux kernel release, found something exploitable that had no CVE at all, and developed a working exploit.
• user5994461 7y ago
  They're both rated medium. Makes me wonder how one come across either of these vulnerabilities in practice. Telnet is disabled by default since windows 7 (that's 10 years ago). You wouldn't see anything internal with telnet unless it's seriously misconfigured or employees doing their own thing to circumvent IT. This should one maybe be upped to high. self signed certificates on the other hand. either there is someone too lazy to obtain public certificates or the scanning tool doesn't accept the internal PKI.
  • rtempaccount1 7y ago
    Endpoints in a network aren't all PCs :) In some industries (e.g. SCADA) Telnet is very much alive. Also even on the Internet, Shodan has about 5.2Milllion hosts with the Telnet port exposed...
• danShumway 7y ago
  I'm not a security researcher, but I've heard your point made in a couple of places, and I've come to agree with it. If you're going to boil everything down to a single, approximated number, you might as well make it obvious that you're approximating. Having scores like 5.8 makes people put more trust than is appropriate into the algorithm.
• badrabbit 7y ago
  I disagree. The point is to help you prioritize based on the threat model and mitigating controls in place. If you have 20 medium vulns you need to know which one has higher complexity to exploit,remote exploitation,authentication required,etc... Ideally a vuln management program will add other in house metrics based on the asset,data and security controls and threat exposure. You have limited resources that can be allocated to testing patches,coordinating deployment,eploying them and making sure there are no adverse side effects and if there are to work with the product vendor or implement controls. CVSS is extremely valuable but more so for proioritizing than for reporting. Executive reports should beuch simpler and usually contain other details such as patch turn around time,exceptions and trends. For the example you mentioned,yes, a false sense of security is worse than no security. You also take into account things like just "telnet,but telnet isn't always used for management or confidential access"(e.g.:lots if meter readers and BAC type devices have read only telnet) vs "self signed cert for a service that probably handles sensitive data which is why it supports encryption to begin with"
  • rtempaccount1 7y ago
    Of course each organization should have their own threat model, mitigations and the like in place. Those organizations also know not to take a CVSS base score as a gospel. However I'd suggest that many organizations are not that sophisticated and that many many organizations take CVSS score base scores as objective measures of vulnerability, and that that is dangerous. Also the point about things like "difficulty to exploit", well that's often subjective and there's no way the analyst assigning the score has a good picture of the real-world likelihood in every case, so the idea that they can assign a universal number to that is incorrect. If an organization wants to use CVSS internally and assign their scores for their environment, with a consistent set of scoring criteria, that could work (although I'd argue high/medium/low would work just as well)
    • badrabbit 7y ago
      Exploitability is relative,as in compared to other bugs of a similar class. Subjwctivity is not always bad. CVSS score is better than nothing.like i said before, high/medium/low is not granular enough. How is it different than having a 3 point numerical scale? Do you disagree with the granularity? Just MS patch tuesday could be dozens of patches. If you have the process you can use cvss as a starting point for generating final risk score. If you don't CVSS provides you with some guidance as to what you should prioritize. It's meant to be an aid not a rule. In the end you should patch all vulns and prioritize as it makes sense in your environment