4 ms·
It started out as a 0-day in 2012, and since it has remained unpatched, it continues to be called a 0-day. That is how it is commonly used.
by dtho 6y ago
It started out as a 0-day in 2012, and since it has remained unpatched, it continues to be called a 0-day. That is how it is commonly used.
- tptacek 6y agoNo, that's not how the term is used.
- deleted 6y ago[deleted]
- AmericanChopper 6y agoKnown vulnerabilities or weaknesses that don’t have patches are not 0-days. A 0-day is a vulnerability that you don’t know exists yet. That’s how the term is used in risk management and threat modelling. You don’t have 0-days that you’ve known about for 8 years. They’re just known risks.
- varenc 6y agoDisagree. An 0-day is only a 0-day for 1 day after public disclosure. (and before) It's a useful distinction. 0-days are special because your target has no idea such a vulnerability even exists. This makes them very different than known but still unpatched vulnerabilities.
- dtho 6y agoHow does that make them very different? The latest version of the software is still exploitable in either case. In my opinion, that is why it's useful to call them 0-days until they are patched.
- varenc 6y agoOne difference: With an 0-day you know your target can't have done anything to specifically mitigate that vulnerability. If a vulnerability is well known but still unpatched by the vendor, a potential target can take their own steps to protect themselves. For example, if you're running some ancient mailing list software that you know has an unpatched XSS vulnerability, you can have your front end servers scan for attempts to exploit that and abort the requests. Or lock it down with a CSP policy. Or if you know your image manipulation library has tons of vulnerabilities, you could run it in a locked-down sandboxed environment where exploitation doesn't get the attacker much of anything.
- eeZah7Ux 6y agoThis is simply absurd. Please stop things making up.