Name of Your Organization:
IBM Internet Security Systems
Web Site:
http://www.iss.net/
Compatible Capability:
Internet Scanner
Capability home page:
http://www-935.ibm.com/services/us/index.wss/offerfamily/iss/a1029097
1) Product Accessibility <CR_2.4>
Provide a short description of how and where your capability is made available to your customers and the public (required):
Internet Scanner 7.0 is available from for download at the ISS web site (http://www.iss.net/download). ISS X-Force Alerts and Advisories are made publicly available to visitors to our web page http://www.iss.net/threats/ThreatList.php customers are notified of new alerts and advisories through our home page, and email notifications.
4) Map Currency Indication <CR_5.1>
Describe how and where your capability indicates the most recent CVE version used to create or update its mappings (required):
Internet Scanner provides CVE related information in both the Common Policy Editor and the IS 7.0 Help file. This includes directs web links to the CVE website.
6) Map Currency Update Time <CR_5.3>
Describe how and where you explain to your customers the timeframe they should expect an update of your capability's mappings to reflect a newly released CVE version (recommended):
The X-Force database team updates new CVE candidates daily, and upon notification of a new CVE version, X-Force updates the X-Force database days after a list of CVE names is available. A statement of these methods are posted on the X-Force FAQ page at http://xforce.iss.net/xforce/xfaq, specifically at http://xforce.iss.net/xforce/xfaq/index.html#6.5. Alerts and Advisories are updated accordingly based on the changes made. Updates to Internet Scanner are provided in the form of XPU updates from the X-Force.
7) CVE and Compatibility Documentation<CR_4.1>
Provide a copy, or directions to its location, of where your documentation describes CVE and CVE compatibility for your customers (required):
X-Force describes CVE with respect to the X-Force Database in the X-Force FAQ document. The section describing MITRE CVE is available at http://xforce.iss.net/xforce/xfaq/index.html#6. This content is used by Internet Scanner 7.0 with respect to supported checks within the solution
8) Documentation of Finding Elements Using CVE Names <CR_4.2>
Provide a copy, or directions to its location, of where your documentation describes the specific details of how your customers can use CVE names to find the individual security elements within your capability's repository (required):
CVE names may be used as a search criterion from the search page at http://xforce.iss.net/xforce/search.php (enhanced database search). The description and procedures have been documented at http://xforce.iss.net/xforce/xfaq/index.html#6.8. CVEs are used as a search criterion within the Common Policy Editor and withing the online Help file.
9) Documentation of Finding CVE Names Using Elements <CR_4.3>
Provide a copy, or directions to its location, of where your documentation describes the process a user would follow to find the CVE names associated with individual security elements within your capability's repository (required):
CVE names may be used from the search page at http://xforce.iss.net/xforce/search.php (enhanced database search). The description and procedures have been documented at http://xforce.iss.net/xforce/xfaq/index.html#6.8.
11) Candidates Versus Entries Indication <CR_6.1>
If CVE candidates are supported or used, explain how you indicate that candidates are not accepted CVE entries (required):
Internet Scanner utilizes the deliverables from the ISS X-Force when it comes to supported CVE Candidates. The X-Force database uses CVE candidate (CAN) names. There are two instances where CVE entries may not be accepted:
- If the CVE candidate has not yet been promoted to a CVE name, then the CAN- prefix is used for all candidates to differentiate them from CVE entries that use the CVE- prefix.
- If a CVE candidate is rejected and MITRE notes this fact in the description, then the X-Force database will display the same description provided by MITRE. However, because our customers often search for all types of CVE names, including those that are unaccepted or rejected, there are no plans to remove or alter CVE names further than updating the description. The X-Force FAQ at http://xforce.iss.net/xforce/xfaq/index.html#6.9 describes how we handle special CVE names, including reserved and rejected names.
12) Candidates Versus Entries Explanation <CR_6.2>
If CVE candidates are supported or used, explain where and how the difference between candidates and entries is explained to your customers (recommended):
The X-Force FAQ page describes the differences between CVE names and candidates at http://xforce.iss.net/xforce/xfaq/index.html#6.2.
13) Candidate to Entry Promotion <CR_6.3>
If CVE candidates are supported or used, explain your policy for changing candidates into entries within your capability and describe where and how this is communicated to your customers (recommended):
X-Force uses discrepancy and change reports to identify which CVE names need to be addressed, changed, or reconciled. These reports are generated by daily runs of script-based processes. A daily run after MITRE issues a Final Decision list for a given CVE version will usually result in a large list of actions, and the resultant work can typically be completed in a few days, depending on current workload and the number of promoted candidates. Products that use the X-Force Database uptake the updated information at the next major product version release, or during the next applicable update. A summary of this policy is available at http://xforce.iss.net/xforce/xfaq/index.html#6.5 and http://xforce.iss.net/xforce/xfaq/index.html#6.6.
14) Candidate and Entry Search Support <CR_6.4>
If CVE candidates are supported or used, explain where and how a customer can find the explanation of your search function's ability to look for candidates and entries by using just the YYYY-NNNN portion of the CVE names (recommended):
The X-Force database search engine supports partial matches of the form YYYY-NNNN. The documentation describing this capability is available at http://xforce.iss.net/xforce/xfaq/index.html#6.8.
15) Search Support for Promoted Candidates <CR_6.5>
If CVE candidates are supported or used, explain where and how a customer can find the explanation of your search function's support for retrieving the CVE entry for a candidate that is no longer a candidate (recommended):
The X-Force database and its search engine do not support cross-checking when the entire CVE or candidate name is provided. X-Force recommends that users search on partial matches of the form YYYY-NNNN. Because X-Force uses automated processes to update CVE names on a daily basis, the promotion of a candidate to CVE status usually displays the update in a matter of hours (for daily updates) or days (for mass-changes such as CVE Final Decisions). The documentation describing this capability is available at http://xforce.iss.net/xforce/xfaq/index.html#6.8. Within the Internet Scanner 7.0 application, users will find CANs in the product by using the Common Policy Editor.
16) Candidate Mapping Currency Indication <CR_6.6>
If CVE candidates are supported or used, explain where and how you tell your users how up-to-date your candidate information is (recommended):
ISS keeps CVE information as up-to-date as possible between releases as described in the following article on our site. http://xforce.iss.net/xforce/xfaq/#6.6.
Type-Specific Capability Questions
17) Finding Tasks Using CVE Names <CR_A.2.1>
Give detailed examples and explanations of how a user can locate tasks in the tool by looking for their associated CVE name (required):
Users can utilize the Common Policy Editor withing Internet Scanner 7.0 in order to find related CVEs and information about the corresponding CVE. Links to the https://cve.mitre.org are also commonly available.
18) Finding CVE Names Using Elements in Reports <CR_A.2.2>
Give detailed examples and explanations of how, for reports that identify individual security elements, the tool allows the user to determine the associated CVE names for the individual security elements in the report (required):
CVE details and links are provided within every policy in Internet Scanner. Each available CVE can be searched for by named and viewed in the report results within the Common Policy Editor. Also, in the reporting engine we can search a report for corresponding CAN or CVE numbers for the vulnerabilities found.
19) Getting a List of CVE Names Associated with Tasks <CR_A.2.4>
Give detailed examples and explanations of how a user can obtain a listing of all of the CVE names that are associated with the tool's tasks (recommended):
A user can obtain a listing or all vulnerabilities and related CVE from within the Common Policy Editor. The user can enter 'CVE' and 'Search'. The total number of vulnerabilities is then listed in the left view pane followed by each vulnerability name. CVEs are then listed in each vulnerability in the right hand view of the Common Policy Editor.
21) Selecting Tasks Using Individual CVE Names <CR_A.2.6>
Describe the steps that a user would follow to browse, select, and deselect a set of tasks for the tool by using individual CVE names (recommended):
In the latest release of Scanner we have a category called CVE. By opening the policy editor a user could select CVE as a category. Once they do this all checks with an associated CVE will be displayed in CVE order. All the user would have to do then is select a particular CVE to activate the check in the policy.
22) Non-Support Notification for a Requested CVE Name <CR_A.2.7>
Provide a description of how the tool notifies the user that task associated to a selected CVE name cannot be performed (recommended):
If there is no check in the policy editor the task associated to a selected CVE cannot be done.
26) Finding Online Capability Tasks Using CVE Names <CR_A.4.1>
Give detailed examples and explanations of how a "find" or "search" function is available to the user to locate tasks in the online capability by looking for their associated CVE name or through an online mapping that links each element of the capability with its associated CVE name(s) (required):
- From the Enhanced Search (http://xforce.iss.net/xforce/search.php) Web page for the X-Force database, enter the CVE name in one of the following formats:
Format Example
CVE-YYYY-NNNN CVE-2003-0001
CAN-YYYY-NNNN CAN-2003-0001
YYYY-NNNN 2003-0001
- Select Search by Keyword. The Keyword Search Results page appears.
- Under the Displaying results list, select the appropriate link for more information. The X-Force Database Results page appears, and the CVE or candidate name appears in the "Standards associated with this entry" section.
Note: Searches may also return results for documents external to the X-Force database, such as advisory bulletins or other documents. This capability is documented at http://xforce.iss.net/xforce/xfaq/index.html#6.8.
27) Online Capability Interface Template Usage <CR_A.4.1.1>
Provide a detailed description of how someone can use your "URL template" to interface to your capability's search function (recommended):
Examples:
http://www.example.com/cgi-bin/db-search.cgi?cvename=CVE-YYYY-NNNN
http://www.example.com/cve/CVE-YYYY-NNNN.htmlFrom the Enhanced Search (http://xforce.iss.net/xforce/search.php) Web page for the X-Force database, enter the CVE name in one of the following formats:
Format Example
CVE-YYYY-NNNN CVE-2003-0001
CAN-YYYY-NNNN CAN-2003-0001
YYYY-NNNN 2003-0001
29) Finding CVE Names Using Online Capability Elements <CR_A.4.2>
Give detailed examples and explanations of how, for reports that identify individual security elements, the online capability allows the user to determine the associated CVE names for the individual security elements in the report (required):
This capability is available on each Web page in the "Standards associated with this entry" section. For CAN and CVE names, the section lists the CVE name, a link to the MITRE CVE entry for the same name (opens in a new browser window), and the description MITRE provides for the CVE name or candidate. This capability is documented at http://xforce.iss.net/xforce/xfaq/index.html#6.7.If the candidate description either reports that it is not yet released or has been deprecated, the X-Force database will contain verbatim information in the description section for that name. This capability is documented at http://xforce.iss.net/xforce/xfaq/index.html#6.9.
For example:
http://xforce.iss.net/xforce/xfdb/10996
CAN-2003-0001: Multiple Ethernet Network Interface Card (NIC) device drivers do not pad frames with null bytes, which allows remote attackers to obtain information from previous packets or kernel memory by using malformed packets, as demonstrated by Etherleak.http://xforce.iss.net/xforce/xfdb/8837
CAN-2002-1234: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. This candidate is a an out-of-band assignment duplicate of CAN-2002-0180. All CVE users should reference CAN-2002-0180 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.<no associated page; example content only>
CAN-2001-0158: ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
31) Electronic Document Format Info <CR_B.3.1>
Provide details about the different electronic document formats that you provide and describe how they can be searched for specific CVE-related text (required):
We provide output in PDF, HTM, and RTF. Each is searchable via the browser, viewer or editor chosen.
32) Electronic Document Listing of CVE Names <CR_B.3.2>
If one of the capability's standard electronic documents only lists security elements by their short names or titles provide example documents that demonstrate how the associated CVE names are listed for each individual security element (required):
Currently, we provide no mapping in our reports on how a CVE name is related to each individual security element.
33) Electronic Document Element to CVE Name Mapping <CR_B.3.3>
Provide example documents that demonstrate the mapping from the capability's individual elements to the respective CVE name(s) (recommended):
Within the Internet Scanner Policy editor there is a search function that allows users to find CVE's that we have the abiltiy to audit systems with. In the latest release of Scanner 7.0 we have the ability to categorize by CVE.
34) Finding Elements Using CVE Names Through the GUI <CR_B.4.1>
Give detailed examples and explanations of how the GUI provides a "find" or "search" function for the user to identify your capability's elements by looking for their associated CVE name(s) (required):
CVE information can be found in the product help text. Internet Scanner help will detail what CVE is and the vulnerability catelog help covers the vulnerabilities with Internet Scanner and how the checks are related CVE definitions. Both help texts can be searched by content, index, search or favorites within the help module.
35) GUI Element to CVE Name Mapping <CR_B.4.2>
Briefly describe how the associated CVE names are listed for the individual security elements or discuss how the user can use the mapping between CVE entries and the capability's elements, also describe the format of the mapping (required):
On our vulnerability tab within the product we have the associated CVE's included in the vulnerability description.
In our policy editor you can customize your policies by creating CVE specific policies by using the categorize feature.
For further information helpful links have been provided to the CVE site.
36) GUI Export Electronic Document Format Info <CR_B.4.3>
Provide details about the different electronic document formats that you provide for exporting or accessing CVE-related data and describe how they can be searched for specific CVE-related text (recommended):
By searching for CVE in our help you can find related information to our checks and links to relevant information on the web.
37) Statement of Compatibility <CR_2.7>
Have an authorized individual sign and date the following Compatibility Statement (required):
"As an authorized representative of my organization I agree that we will abide by all of the mandatory CVE Compatibility Requirements as well as all of the additional mandatory CVE Compatibility Requirements that are appropriate for our specific type of capability."
Name: Scott Johnson
Title: Internet Scanner Product Manager
38) Statement of Accuracy <CR_3.4>
Have an authorized individual sign and date the following accuracy Statement (recommended):
"As an authorized representative of my organization and to the best of my knowledge, there are no errors in the mapping between our capability's Repository and the CVE entries our capability identifies."
Name: Luanne Johnson
Title: Team Lead for the X-Force database
39) Statement on False-Positives and False-Negatives <CR_A.2.8 and/or CR_A.3.5>
FOR TOOLS ONLY - Have an authorized individual sign and date the following statement about your tools efficiency in identification of security elements (required):
"As an authorized representative of my organization and to the best of my knowledge, normally when our capability reports a specific security element, it is generally correct and normally when an event occurs that is related to a specific security element our capability generally reports it."
Name: Luanne Johnson
Title: Team Lead for the X-Force database
