3 ms·
Zed will act as a clearing house? There's no danger scale (CVSS or whatever) for customers and no comp for, ahh, researchers. I don't understand how this will w
by zwp 16y ago
Zed will act as a clearing house? There's no danger scale (CVSS or whatever) for customers and no comp for, ahh, researchers. I don't understand how this will work.
Also clearly demonstrated that it's easy to submit reports. So...
1. Spam vulnarb.com with vulns in my competitor's software.
2. Spam vulnarb.com with vulns in my own company (maybe I can spin this... "1239801211 vuln reports against us... vulnarb clearly not to be trusted... our robust and mature security team always available...". Any press is good press right?)
3. Spam anybody I like in there, bury my product's issues. How exactly does Joe Customer realistically compare software using this? ("I want to view PDFs, should I use Acrobat, Foxit, evince, xpdf?").
3b. Spam vulnarb.com with faux vulnarb.com vulns :-p
- zedshaw 16y agoSo, block spam and identify people to avoid is what you're saying? Done. Now what?
- zwp 16y agoFaux vulnerability reports might be slightly harder to spot than your average Nigerian Princess. Will you validate my exploit for IBM RACF on OS/390?
- zedshaw 16y agoIt's easy. Vendor decrypts it. It gets ignored. Done.
- zwp 16y agoThe process isn't clear to me. So the vendor communicates "fixed" to you? Or do I report to the vendor and to you simultaneously using this mechanism, and then I subsequently follow up with you? Does the vendor communicate with me? You? Both of us? How? What happens in disputed cases? (eg I have reported unsafe calls in signal handlers to be told "no working exploit, no fix"). Now what? I still have to publicly disclose vulns in my own infrastructure to get traction? What have I gained by going to vulnarb? Even assuming consumers consult such a service what can they learn if the details (severity) of the issues is not available? I don't think I can sell this to my CSO ("there's a guy on the 'net that says I should send him encrypted text of exploits that I've found in our infrastructure"). And for stuff that doesn't touch my day job: what's your sales pitch over ZDI? I thought the shell script was neat but sorry, I'm not really compelled by your service proposition. EDIT: your _current_ service proposition ;-)
- chrismsnz 16y agoThe vendor indicates "fixed" by posting the decrypted exploit data against their entry in Zed's database. If the bug was benign in the first place, they can post the decrypted exploit without worrying about it or doing anything.
- zwp 16y agoEven when a bug has been fixed in trunk a vendor may not wish to reveal the details of an exploit (either publicly or "just to zed"). A sensitive researcher may not wish their details of their techniques or findings to be revealed to a wider audience. For context only (I don't want to do the responsible disclosure debate again...) please consider eg recent bugtraq SCADA announcent or Sockstress.
- schof 16y agoSo. I submit a vuln that says "Product X has vulnerability Y." The vendor decrypts this, and marks it as fixed in your database by submitting "decrypted" text that says "I like ponies."
- fczuardi 16y agoThe encrypted “I like ponies” would not match the encrypted “Product X has vulnerability Y”