RE: CVE Must-Have Coverage

[Mike Prosser <mprosser@symantec.com>]

Hi Dave, all

I've been lurking on the list since I am no longer an active participant on the editorial board in my current position.  

In our case, Symantec product advisories are always posted to the Security Focus site as well as to our Advisory page.  The Security Focus site being the much better one to monitor as has been recommended here.  We also coordinate with the finder's/submitters with URLs to our advisories and CVEs, if they don't acquire them, so they can include the info in their advisories/bulletins.

Assume that's a similar case for at least some of the other Non-OS vendors.

-Mike
Symantec Product Security Team
-----Original Message-----
From: owner-cve-editorial-board-list@lists.mitre.org [mailto:owner-cve-editorial-board-list@lists.mitre.org] On Behalf Of Mann, Dave
Sent: Tuesday, October 11, 2011 3:04 PM
To: cve-editorial-board-list
Subject: CVE Must-Have Coverage

Folks,

Below, please find a somewhat stabilizing set of vulnerability sources.

I've tried to capture the best consensus (not pure votes but close).

Please review the list and holler loudly and quickly if you see something you can't live with.   This is a living document so nothing is cast in stone.  Still gaining a level of agreement on the scope is a necessary first step.

I'm particularly concerned at the almost complete lack of desktop or enterprise software packages being called out by vendor.

Some are listed but by no means the majority.  The implication to me is that we're very much relying on non-vendor sources to shed light on these types of software.


-Dave
==================================================================
David Mann | Principal Infosec Scientist | The MITRE Corporation
------------------------------------------------------------------
e-mail:damann@mitre.org | cell:781.424.6003
==================================================================

CVE VULNERABILITY INFORMATION SOURCES - PRIORITY


Government & Related Information Sources
  Must Have
    US-CERT Advisories (aka CERT-CC Advisories) 
    US-CERT Vulnerability Notes (CERT-CC) 
    US-CERT Bulletins (aka Cyber-Notes)   
    CMU/CERT-CC                                 
    DoD IAVAs                             
  Nice To Have
    NISCC                                 
    AUS-CERT                              
    DOE CIRC (formerly CIAC)               


Vendor Published Information
  Must Have
    Microsoft                                   
    RedHat                                      
    Apache                                      
    Apple OSX                                   
    Oracle                                      
    Solaris                                     
    Suse                                        
    Mandriva                                    
    HP-UX                                       
    AIX                                         
    Cisco IOS                                   
    Free BSD                                    
    Open BSD                                    
    Net BSD                                     
    Gentoo (Linux)                              
    Ubuntu (Linux)                              
    Adobe
    Mozilla
    Google Chrome
  Nice To Have  
    Debian                                      
    SCO     
    Cisco


Mailing Lists & VDBs
  Must Have
    Bugtraq                                     
    Full Disclosure                             
    Security Focus                              
    Security Tracker                            
    OSVDB                                       
    Oss-security                                
  Nice To Have
    ISS X-Force                                 
    FRSIRT  (VUPEN)                             
    Secunia                                     
    SecuriTeam                                  
    Metasploit                                  
    Snort                                       
    Contagiodump.blogspot.com                   
  Ignore
    Vuln-Watch                                  
    VulnDev                                     
    Packet Storm                                
    SANS Mailing List (Qualys)                  ]
    Neohapsis (Security Threat Watch)