Re: CD MODIFICATION: DEFINITION version 2 - Interim Decision 8/30

[Stephen Moore <sjmoore@mitre.org>]

ACCEPT

"Steven M. Christey" wrote:
> 
> Please vote on the following modification to the DEFINITION content
> decision, which uses the new "exposure" terminology.
> 
> Our proposal for the use of the "exposure" term has received very
> little commentary, but since it (a) requires a change to the CVE name
> itself, and (b) attempts to resolve some of the most significant
> debates that have occurred on the Editorial Board list so far, it is
> critical that adoption of this terminology be decided ASAP.
> 
> VOTE:
> 
> (Member may vote ACCEPT, MODIFY, REJECT, or NOOP.)
> 
> Short Description
> -----------------
> 
> In an attempt to remain independent of the multiple perspectives of
> what a "vulnerability" is, the CVE identifies both "universal
> vulnerabilities" (i.e. those problems that are normally regarded as
> vulnerabilities within the contect of all reasonable security
> policies) and "exposures" (i.e. problems that are only violations of
> some reasonable security policies).
> 
> Definitions
> -----------
> 
> A "universal" vulnerability is one that is considered a vulnerability
> under any commonly used security policy which includes at least some
> requirements for minimizing the threat from an attacker.  (This
> excludes entirely "open" security policies in which all users are
> trusted, or where there is no consideration of risk to the system.)
> 
> The following guidelines, while imprecise, provide the basis of a
> "universal vulnerability" definition.  A universal vulnerability is a
> state in a computing system (or set of systems) which either:
>   - allows an attacker to execute commands as another user
>   - allows an attacker to access data that is contrary to the
>     specified access restrictions for that data
>   - allows an attacker to pose as another entity
>   - allows an attacker to conduct a denial of service
> 
> The following guidelines provide the basis for a definition of an
> "exposure."  An exposure is a state in a computing system (or set of
> systems) which is not a universal vulnerability, but either:
>   - allows an attacker to conduct information gathering activities
>   - allows an attacker to hide activities
>   - includes a capability that behaves as expected, but can be easily
>     compromised
>   - is a primary point of entry that an attacker may attempt to use
>     to gain access to the system or data
>   - is considered a problem according to some reasonable security
>     policy
> 
> Rationale
> ---------
> 
> Discussions on the Editorial Board mailing list and during the CVE
> Review meetings indicate that there is no definition for a
> "vulnerability" that is acceptable to the entire community.  At least
> two different definitions of vulnerability have arisen and been
> discussed.  There appears to be a universally accepted, historically
> grounded, "core" definition which deals primarily with specific flaws
> that directly allow some compromise of the system (a "universal"
> definition).  A broader definition includes problems that don't
> directly allow compromise, but could be an important component of a
> successful attack, and are a violation of some security policies (a
> "contingent" definition).
> 
> In accordance with the original stated requirements for the CVE, the
> CVE should remain independent of multiple perspectives.  Since the
> definition of "vulnerability" varies so widely depending on context
> and policy, the CVE should avoid imposing an overly restrictive
> perspective on the vulnerability definition itself.  Therefore, the
> term "universal vulnerability" is to be applied to those CVE entries
> which are considered vulnerabilities under any security policy (and
> thus by any perspective), and "exposure" is to be applied to the
> remaining CVE entries which include violations of *some* reasonable
> security policy.
> 
> Examples
> --------
> 
> Examples of universal vulnerabilities include:
>   - phf (remote command execution as user "nobody")
>   - rpc.ttdbserverd (remote command execution as root)
>   - world-writeable password file (modification of system-critical
>     data)
>   - default password (remote command execution or other access)
>   - denial of service problems that allow an attacker to cause a Blue
>     Screen of Death
>   - smurf (denial of service by flooding a network)
> 
> Examples of exposures include:
>   - running services such as finger (useful for information gathering,
>     though it works as advertised)
>   - inappropriate settings for Windows NT auditing policies (where
>     "inappropriate" is enterprise-specific)
>   - running services that are common attack points (e.g. HTTP, FTP, or
>     SMTP)
>   - use of applications or services that can be successfully attacked
>     by brute force methods (e.g. use of trivially broken encryption,
>     or a small key space)

-- 
Stephen Moore
Lead Infosec Engineer
The MITRE Corporation
sjmoore@mitre.org