3 ms·

Two of the Microsoft CVEs (CVE-2017-11882, CVE-2020-0787) on this list are listed as "Exploitation Less Likely" if you view Microsoft's own info for those CVEs.

Two of the Microsoft CVEs (CVE-2017-11882, CVE-2020-0787) on this list are listed as "Exploitation Less Likely" if you view Microsoft's own info for those CVEs. I guess you can't trust the vendor to determine how exploitable a vulnerability is?

lucb1e 5y ago
> I guess you can't trust the vendor to determine how exploitable a vulnerability is? Not Microsoft at least. Most vendors, and the percentage grows with the size of the vendor, are very coy about it. And I get it: it doesn't look great for your shareholders, and it gets to a point where yes really you should be ashamed (looking at HP Data Protector here (note the irony)), but if you own it up and also put countermeasures and hardening in place then really everyone is going to feel like they got their money's worth in the end. If instead you hide vulnerabilities, not mention them in changelogs so we can't even check which version is fixed or anything, yeah we'll be recommending the client to look at alternatives. (Though it's not us security consultants that ever recommended a sysadmin to put a proprietary VPN in place in the first place, but then there's more at play than purely the security aspect.) Microsoft's advantage, of course: try getting out of that ecosystem if you have everyone implicitly trained in using Outlook and Windows. Microsoft gets to do with their advisories whatever the hell they like.
- zeusk 5y ago
  The page says "at the time of original publication." right after exploit likelihood; with patch released for it as well. So it's more like victims not updating their software.
  - lucb1e 5y ago
    Exploitation not being likely after installing the patch is like saying you're not likely to fall if you lie down first. But yes, of course the #1 recommendation is for our clients to Always Install Patches Immediately. Always. And they never ever do it. For comparison, though, OpenSSH needed to be updated for a critical vulnerability last in... 2002, maybe? Secure protocols can be done, so it's not only the people not installing updates that are to blame here.
    - zeusk 5y ago
      Exploitation likeliness after patch doesn't really make sense. maybe you're reading it wrong? See the page for yourself. Exploitation unlikely at the time of exploit discovery. A patch has been released. This means, the reason why it shows up on the list is because people are running unpatched software. And it's really alarming because the 2017 CVE is for Office 2007 that's ~15 years old (with a patch available!).
      - lucb1e 5y ago
        Then I'm not sure what you meant to say about the patch being available and thus the problem just being not updating. The "exploitation not likely" statement is simply wrong if it's in the top list of this agency right? Replying to your edit: > that's ~15 years old (with a patch available!) I haven't looked into this one, but you mention it's a 2017 CVE. That means the vuln was discovered (not even necessarily patched and disclosed) in 2017 and not 15 years ago. The age of the product isn't the same as how fast they install security updates (but yeah apparently 2-3 years depending on the exact timeline (the stats are from 2020), so that's practically never).
        zeusk 5y ago
        >> I haven't looked into this one, but you mention it's a 2017 CVE. That means the vuln was discovered (not even necessarily patched and disclosed) in 2017 and not 15 years ago. Sure, but it's a CVE for a 15 year old software. At this point, running 15 year old software unpatched on machines connected to internet is just negligence on user's part. Maybe we do need forced updates as default.
        genewitch 5y ago
        Patches annoy end users. A lot. Anecdote: latest set of windows patches did something to Bluetooth, such that when I switch my mouse between machines there's up to a 3 second lag before the cursor is responsive. Big deal, minor nuisance, right? Except if I'm in a Fullscreen application, it causes a blue screen because the os waiting for the mouse to handshake pauses the GPU for some reason, and the GPU-Windows framework panics and blue screens to prevent hardware damage. This has the side effect of corrupting the application that was running during the blue screen, sometimes forcing a reinstall. I have no idea what patch it was that caused this, nor can I really expect anyone to fix it, how often are most(98%?) users connecting and disconnecting their mouse every day? I'm switching it dozens of times an hour.
- tptacek 5y ago
  Microsoft is not managing vulnerability exploit likelihood for their shareholders. Different vendors are more or less conservative about how they rate exploit severity, and nobody is more conservative than the major open source projects, where any memory corruption vulnerability, even if it's a read-only NULL deref, is rated "possible code execution".

lucb1e 5y ago

> I guess you can't trust the vendor to determine how exploitable a vulnerability is? Not Microsoft at least. Most vendors, and the percentage grows with the size of the vendor, are very coy about it. And I get it: it doesn't look great for your shareholders, and it gets to a point where yes really you should be ashamed (looking at HP Data Protector here (note the irony)), but if you own it up and also put countermeasures and hardening in place then really everyone is going to feel like they got their money's worth in the end. If instead you hide vulnerabilities, not mention them in changelogs so we can't even check which version is fixed or anything, yeah we'll be recommending the client to look at alternatives. (Though it's not us security consultants that ever recommended a sysadmin to put a proprietary VPN in place in the first place, but then there's more at play than purely the security aspect.) Microsoft's advantage, of course: try getting out of that ecosystem if you have everyone implicitly trained in using Outlook and Windows. Microsoft gets to do with their advisories whatever the hell they like.

zeusk 5y ago
The page says "at the time of original publication." right after exploit likelihood; with patch released for it as well. So it's more like victims not updating their software.
- lucb1e 5y ago
  Exploitation not being likely after installing the patch is like saying you're not likely to fall if you lie down first. But yes, of course the #1 recommendation is for our clients to Always Install Patches Immediately. Always. And they never ever do it. For comparison, though, OpenSSH needed to be updated for a critical vulnerability last in... 2002, maybe? Secure protocols can be done, so it's not only the people not installing updates that are to blame here.
  - zeusk 5y ago
    Exploitation likeliness after patch doesn't really make sense. maybe you're reading it wrong? See the page for yourself. Exploitation unlikely at the time of exploit discovery. A patch has been released. This means, the reason why it shows up on the list is because people are running unpatched software. And it's really alarming because the 2017 CVE is for Office 2007 that's ~15 years old (with a patch available!).
    - lucb1e 5y ago
      Then I'm not sure what you meant to say about the patch being available and thus the problem just being not updating. The "exploitation not likely" statement is simply wrong if it's in the top list of this agency right? Replying to your edit: > that's ~15 years old (with a patch available!) I haven't looked into this one, but you mention it's a 2017 CVE. That means the vuln was discovered (not even necessarily patched and disclosed) in 2017 and not 15 years ago. The age of the product isn't the same as how fast they install security updates (but yeah apparently 2-3 years depending on the exact timeline (the stats are from 2020), so that's practically never).
      - zeusk 5y ago
        >> I haven't looked into this one, but you mention it's a 2017 CVE. That means the vuln was discovered (not even necessarily patched and disclosed) in 2017 and not 15 years ago. Sure, but it's a CVE for a 15 year old software. At this point, running 15 year old software unpatched on machines connected to internet is just negligence on user's part. Maybe we do need forced updates as default.
        genewitch 5y ago
        Patches annoy end users. A lot. Anecdote: latest set of windows patches did something to Bluetooth, such that when I switch my mouse between machines there's up to a 3 second lag before the cursor is responsive. Big deal, minor nuisance, right? Except if I'm in a Fullscreen application, it causes a blue screen because the os waiting for the mouse to handshake pauses the GPU for some reason, and the GPU-Windows framework panics and blue screens to prevent hardware damage. This has the side effect of corrupting the application that was running during the blue screen, sometimes forcing a reinstall. I have no idea what patch it was that caused this, nor can I really expect anyone to fix it, how often are most(98%?) users connecting and disconnecting their mouse every day? I'm switching it dozens of times an hour.
tptacek 5y ago
Microsoft is not managing vulnerability exploit likelihood for their shareholders. Different vendors are more or less conservative about how they rate exploit severity, and nobody is more conservative than the major open source projects, where any memory corruption vulnerability, even if it's a read-only NULL deref, is rated "possible code execution".