Name of Your Organization:

The MITRE Corporation

Web Site:

http://www.mitre.org/

Compatible Capability:

Open Vulnerability and Assessment Language (OVAL) Web site

Capability home page:

http://oval.mitre.org

1) Product Accessibility <CR_2.4>

Provide a short description of how and where your capability is made available to your customers and the public (required):

The OVAL web site is freely available to anyone on the Internet at http://oval.mitre.org.

4) Map Currency Indication <CR_5.1>

Describe how and where your capability indicates the most recent CVE version used to create or update its mappings (required):

OVAL uses the publicly known vulnerabilities identified in the CVE List as the basis for most of the queries. OVAL's CVE and Compatibility documentation includes the CVE version number used.

5) Map Currency Update Approach <CR_5.2>

Indicate how often you plan on updating the mappings to reflect new CVE versions and describe your approach to keeping reasonably current with CVE versions when mapping them to your repository (recommended):

When a new version of CVE is released, all changes to CVE candidate and entry names included on the OVAL web site will be updated within 30 days.

6) Map Currency Update Time <CR_5.3>

Describe how and where you explain to your customers the timeframe they should expect an update of your capability's mappings to reflect a newly released CVE version (recommended):

Updates to the OVAL web site are announced to the Community Forum Email List (oval-discussion-list@lists.mitre.org). Changes made to the OVAL queries resulting from a new CVE version are announced to this list. Archives of these discussions are also available on the OVAL web site at http://oval.mitre.org/community/forum/archives/.

7) CVE and Compatibility Documentation<CR_4.1>

Provide a copy, or directions to its location, of where your documentation describes CVE and CVE compatibility for your customers (required):

OVAL's CVE and Compatibility documentation is included with this questionnaire. The document is included on the public web site at http://oval.mitre.org/about/compstatement.html.

8) Documentation of Finding Elements Using CVE Names <CR_4.2>

Provide a copy, or directions to its location, of where your documentation describes the specific details of how your customers can use CVE names to find the individual security elements within your capability's repository (required):

OVAL provides the user with a "View Queries by CVE name" function that allows the user to select a CVE name and retrieve the related OVAL query or queries (http://oval.mitre.org/oval/review/queries/cveid.html). This is stated in OVAL's CVE and Compatibility documentation.

9) Documentation of Finding CVE Names Using Elements <CR_4.3>

Provide a copy, or directions to its location, of where your documentation describes the process a user would follow to find the CVE names associated with individual security elements within your capability's repository (required):

The web page displayed for each OVAL query includes the CVE entry name which maps to that query. The queries can be reviewed at http://oval.mitre.org/oval/review/.

11) Candidates Versus Entries Indication <CR_6.1>

If CVE candidates are supported or used, explain how you indicate that candidates are not accepted CVE entries (required):

OVAL queries are developed for CVE candidates as well as accepted CVE entries. Indication that the candidate name is not an accepted CVE entry is given to the user through the use of the CAN- prefix itself. The difference between candidates and entries is also indicated in OVAL's CVE and Compatibility documentation.

12) Candidates Versus Entries Explanation <CR_6.2>

If CVE candidates are supported or used, explain where and how the difference between candidates and entries is explained to your customers (recommended):

The difference between CVE candidates and official CVE entries is explained in OVAL's CVE and Compatibility documentation.

13) Candidate to Entry Promotion <CR_6.3>

If CVE candidates are supported or used, explain your policy for changing candidates into entries within your capability and describe where and how this is communicated to your customers (recommended):

If a CVE candidate has become an official CVE entry since the prior CVE version, then the candidate name will be replaced with the associated CVE name within 30 days. Changes made to the OVAL queries are announced to the Community Forum Email List (oval-discussion-list@lists.mitre.org). Archives of these discussions are also available on the OVAL web site at http://oval.mitre.org/community/forum/archives/.

14) Candidate and Entry Search Support <CR_6.4>

If CVE candidates are supported or used, explain where and how a customer can find the explanation of your search function's ability to look for candidates and entries by using just the YYYY-NNNN portion of the CVE names (recommended):

OVAL provides the user with a "View Queries by CVE name" function that allows the user to select a CVE candidate or entry name and retrieve the related OVAL query or queries. The difference between candidates and entries is discussed in OVAL's CVE and Compatibility documentation.

15) Search Support for Promoted Candidates <CR_6.5>

If CVE candidates are supported or used, explain where and how a customer can find the explanation of your search function's support for retrieving the CVE entry for a candidate that is no longer a candidate (recommended):

The difference between CVE candidates and entries is discussed in OVAL's CVE and Compatibility documentation.

16) Candidate Mapping Currency Indication <CR_6.6>

If CVE candidates are supported or used, explain where and how you tell your users how up-to-date your candidate information is (recommended):

OVAL's CVE and Compatibility documentation includes the CVE version number used. Also, changes made to the OVAL queries are announced to the Community Forum Email List (oval-discussion-list@lists.mitre.org), which is archived at http://oval.mitre.org/community/forum/archives/.

Type-Specific Capability Questions

26) Finding Online Capability Tasks Using CVE Names <CR_A.4.1>

Give detailed examples and explanations of how a "find" or "search" function is available to the user to locate tasks in the online capability by looking for their associated CVE name or through an online mapping that links each element of the capability with its associated CVE name(s) (required):

http://oval.mitre.org/oval/review/queries/cveid.html allows the user to "View Queries by CVE name", enabling the user to select a CVE name and retrieve the related OVAL query or queries. OVAL queries can also be reviewed at http://oval.mitre.org/oval/review/. The web page displayed for each query includes the CVE name which maps to that query.

27) Online Capability Interface Template Usage <CR_A.4.1.1>

Provide a detailed description of how someone can use your "URL template" to interface to your capability's search function (recommended):

Examples:

http://www.example.com/cgi-bin/db-search.cgi?cvename=CVE-YYYY-NNNN
http://www.example.com/cve/CVE-YYYY-NNNN.html

At http://oval.mitre.org/oval/review/ queries can be viewed by OVAL-ID, Platform, Status, or CVE name.

29) Finding CVE Names Using Online Capability Elements <CR_A.4.2>

Give detailed examples and explanations of how, for reports that identify individual security elements, the online capability allows the user to determine the associated CVE names for the individual security elements in the report (required):

The CVE name is prominently featured next to the OVAL-ID on each query's web page. Example for CVE-2002-0018: http://oval.mitre.org/oval/review/queries/OVAL159.html

31) Electronic Document Format Info <CR_B.3.1>

Provide details about the different electronic document formats that you provide and describe how they can be searched for specific CVE-related text (required):

OVAL queries are available over the Internet and can be searched by using the browser's "find" or "search" function.

32) Electronic Document Listing of CVE Names <CR_B.3.2>

If one of the capability's standard electronic documents only lists security elements by their short names or titles provide example documents that demonstrate how the associated CVE names are listed for each individual security element (required):

Example from "View Queries by CVE name" http://oval.mitre.org/oval/review/queries/cveid.html

CAN-2002-0863 OVAL199
CAN-2002-1317 OVAL149, OVAL152
CAN-2003-0027 OVAL120, OVAL195

33) Electronic Document Element to CVE Name Mapping <CR_B.3.3>

Provide example documents that demonstrate the mapping from the capability's individual elements to the respective CVE name(s) (recommended):

The CVE name is prominently featured next to the OVAL-ID on each query's web page. Example for CVE-2002-0018: http://oval.mitre.org/oval/review/queries/OVAL159.html