Name of Your Organization:
IBM Internet Security Systems
Web Site:
http://www.iss.net/
Compatible Capability:
SiteProtector
Capability home page:
http://www.iss.net/products_services/enterprise_protection/rssite_protector/siteprotector.php
1) Product Accessibility <CR_2.4>
Provide a short description of how and where your capability is made available to your customers and the public (required):
SiteProtector is made available on the ISS download center for free evaluation with all of the ISS products it manages. http://www.iss.net/download/
4) Map Currency Indication <CR_5.1>
Describe how and where your capability indicates the most recent CVE version used to create or update its mappings (required):
SiteProtector accesses CVE information from the X-Force Database. The X-Force Database updates its mappings as follows:
The X-Force database uses the latest CVE version available. X-Force performs reconciliation between CVE and the X-Force database using daily updates as reported from the CERIAS/Purdue University CVE-diff mailing list (CVE_diff@cerias.purdue.edu). X-Force maintains an X-Force FAQ Web page (http://xforce.iss.net/xforce/xfaq) describing the X-Force database, the current CVE version information, in addition to details of how ISS X-Force represents and updates CVE information in the X-Force Database. The CVE version is located at specifically at http://xforce.iss.net/xforce/xfaq/index.html#6.6.
5) Map Currency Update Approach <CR_5.2>
Indicate how often you plan on updating the mappings to reflect new CVE versions and describe your approach to keeping reasonably current with CVE versions when mapping them to your repository (recommended):
SiteProtectors CVE mappings are based on integration with the X-Force Database.
The X-Force database uses the daily mappings as reported from the CERIAS/Purdue University CVE-diff mailing list (CVE_diff@cerias.purdue.edu). When new CVE versions are available, ISS X-Force automatically receives daily discrepancy and change reports generated by scripts to report differences between the MITRE CVE and X-Force databases, and then X-Force researchers make appropriate adjustments to reconcile the differences.
6) Map Currency Update Time <CR_5.3>
Describe how and where you explain to your customers the timeframe they should expect an update of your capability's mappings to reflect a newly released CVE version (recommended):
SiteProtectos CVE mappings are based on integration with X-Force Database.
The X-Force database team updates new CVE candidates daily, and upon notification of a new CVE version, X-Force updates the X-Force database days after a list of CVE names is available. A statement of these methods are posted on the X-Force FAQ page at http://xforce.iss.net/xforce/xfaq, specifically at http://xforce.iss.net/xforce/xfaq/index.html#6.5.
7) CVE and Compatibility Documentation<CR_4.1>
Provide a copy, or directions to its location, of where your documentation describes CVE and CVE compatibility for your customers (required):
SiteProtector describes CVE with respect to the X-Force Database in the X-Force FAQ document. The section describing MITRE CVE is available at http://xforce.iss.net/xforce/xfaq/index.html#6. Also in the SiteProtector Product help files the CVE numbers associated with the signatures detail the associated CVE and a mitre.org link to the CVE.
8) Documentation of Finding Elements Using CVE Names <CR_4.2>
Provide a copy, or directions to its location, of where your documentation describes the specific details of how your customers can use CVE names to find the individual security elements within your capability's repository (required):
In the SiteProtector Strategy Guide available on the download center describes how to use CVE numbers in researching vulnerabilities.
9) Documentation of Finding CVE Names Using Elements <CR_4.3>
Provide a copy, or directions to its location, of where your documentation describes the process a user would follow to find the CVE names associated with individual security elements within your capability's repository (required):
SiteProtector Help information explains in detail how to use the CVE numbers in SiteProtector event analysis. To access this help information open the SiteProtector Console and select the help menu, Search for CVE and it will explain the process.
10) Documentation Indexing of CVE-Related Material <CR_4.4>
If your documentation includes an index, provide a copy of the items and resources that you have listed under "CVE" in your index. Alternately, provide directions to where these "CVE" items are posted on your web site (recommended):
When searching in the index of the help provided in SiteProtector you receive a complete list of all events associated with CVE numbers. This index lists 500 events at a time. Additionally they can be found at http://xforce.iss.net/xforce/search.php.
11) Candidates Versus Entries Indication <CR_6.1>
If CVE candidates are supported or used, explain how you indicate that candidates are not accepted CVE entries (required):
We do not list the CVE or CAN number in the associated help information.
12) Candidates Versus Entries Explanation <CR_6.2>
If CVE candidates are supported or used, explain where and how the difference between candidates and entries is explained to your customers (recommended):
In the help files explaining how to use the CAN and CVE information it details the significance of these numbers in the help files.
13) Candidate to Entry Promotion <CR_6.3>
If CVE candidates are supported or used, explain your policy for changing candidates into entries within your capability and describe where and how this is communicated to your customers (recommended):
Since SiteProtector derives all of its help information regarding CVE's from the X-Force it depends on the X-Force to update these. The following is X-Forces explanation of how they change candidates.
X-Force uses discrepancy and change reports to identify which CVE names need to be addressed, changed, or reconciled. These reports are generated by daily runs of script-based processes. A daily run after MITRE issues a Final Decision list for a given CVE version will usually result in a large list of actions, and the resultant work can typically be completed in a few days, depending on current workload and the number of promoted candidates. Products that use the X-Force Database uptake the updated information at the next major product version release, or during the next applicable update. A summary of this policy is available at http://xforce.iss.net/xforce/xfaq/index.html#6.5 and http://xforce.iss.net/xforce/xfaq/index.html#6.6.
14) Candidate and Entry Search Support <CR_6.4>
If CVE candidates are supported or used, explain where and how a customer can find the explanation of your search function's ability to look for candidates and entries by using just the YYYY-NNNN portion of the CVE names (recommended):
This information is contained in the Help which is accessed directly from the SiteProtector Console.
15) Search Support for Promoted Candidates <CR_6.5>
If CVE candidates are supported or used, explain where and how a customer can find the explanation of your search function's support for retrieving the CVE entry for a candidate that is no longer a candidate (recommended):
This information is contained in the Help which is accessed directly from the SiteProtector Console.
16) Candidate Mapping Currency Indication <CR_6.6>
If CVE candidates are supported or used, explain where and how you tell your users how up-to-date your candidate information is (recommended):
This information is available at
http://xforce.iss.net/xforce/xfaq/index.html#6.6
http://xforce.iss.net/xforce/xfaq/index.html#6.5
Type-Specific Capability Questions
17) Finding Tasks Using CVE Names <CR_A.2.1>
Give detailed examples and explanations of how a user can locate tasks in the tool by looking for their associated CVE name (required):
Users can determine a list of CVE related security vulnerabilities in the help files and then search for those vulnerabilities that have been discovered in their environment.
18) Finding CVE Names Using Elements in Reports <CR_A.2.2>
Give detailed examples and explanations of how, for reports that identify individual security elements, the tool allows the user to determine the associated CVE names for the individual security elements in the report (required):
Vulnerability reports containing the help information list the CVE related numbers in the report.
19) Getting a List of CVE Names Associated with Tasks <CR_A.2.4>
Give detailed examples and explanations of how a user can obtain a listing of all of the CVE names that are associated with the tool's tasks (recommended):
When creating a Internet Scanner policy (vulnerability assessment tool managed by SiteProtector) from within SiteProtector it is possible to search for vulnerabilities in the policy by those that have a particular CVE number.
26) Finding Online Capability Tasks Using CVE Names <CR_A.4.1>
Give detailed examples and explanations of how a "find" or "search" function is available to the user to locate tasks in the online capability by looking for their associated CVE name or through an online mapping that links each element of the capability with its associated CVE name(s) (required):
- From the Enhanced Search (http://xforce.iss.net/xforce/search.php) Web page for the X-Force database, enter the CVE name in one of the following formats:
Format Example
CVE-YYYY-NNNN CVE-2003-0001
CAN-YYYY-NNNN CAN-2003-0001
YYYY-NNNN 2003-0001
- Select Search by Keyword. The Keyword Search Results page appears.
- Under the Displaying results list, select the appropriate link for more information. The X-Force Database Results page appears, and the CVE or candidate name appears in the "Standards associated with this entry" section.
Note: Searches may also return results for documents external to the X-Force database, such as advisory bulletins or other documents. This capability is documented at http://xforce.iss.net/xforce/xfaq/index.html#6.8.
27) Online Capability Interface Template Usage <CR_A.4.1.1>
Provide a detailed description of how someone can use your "URL template" to interface to your capability's search function (recommended):
Examples:
http://www.example.com/cgi-bin/db-search.cgi?cvename=CVE-YYYY-NNNN
http://www.example.com/cve/CVE-YYYY-NNNN.htmlURL template:
http://xforce.iss.net/xforce/search.php?type=2&pattern=CVE-YYYY-NNNNSpecific examples:
http://xforce.iss.net/xforce/search.php?type=2&pattern=CAN-2003-0001
http://xforce.iss.net/xforce/search.php?type=2&pattern=2003-0001
29) Finding CVE Names Using Online Capability Elements <CR_A.4.2>
Give detailed examples and explanations of how, for reports that identify individual security elements, the online capability allows the user to determine the associated CVE names for the individual security elements in the report (required):
This capability is available on each Web page in the "Standards associated with this entry" section. For CAN and CVE names, the section lists the CVE name, a link to the MITRE CVE entry for the same name (opens in a new browser window), and the description MITRE provides for the CVE name or candidate. This capability is documented at http://xforce.iss.net/xforce/xfaq/index.html#6.7.If the candidate description either reports that it is not yet released or has been deprecated, the X-Force database will contain verbatim information in the description section for that name. This capability is documented at http://xforce.iss.net/xforce/xfaq/index.html#6.9.
For example:
http://xforce.iss.net/xforce/xfdb/10996
CAN-2003-0001: Multiple Ethernet Network Interface Card (NIC) device drivers do not pad frames with null bytes, which allows remote attackers to obtain information from previous packets or kernel memory by using malformed packets, as demonstrated by Etherleak.http://xforce.iss.net/xforce/xfdb/8837
CAN-2002-1234: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. This candidate is a an out-of-band assignment duplicate of CAN-2002-0180. All CVE users should reference CAN-2002-0180 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.<no associated page; example content only>
CAN-2001-0158: ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
31) Electronic Document Format Info <CR_B.3.1>
Provide details about the different electronic document formats that you provide and describe how they can be searched for specific CVE-related text (required):
All public-facing documents on the X-Force database are in HTML and PHP. Because the documents are plaintext with markup elements included, they may be searched by a variety of conventional methods (web browser's Find command, grep, etc.) and search engines (Google, htDig, etc.).
32) Electronic Document Listing of CVE Names <CR_B.3.2>
If one of the capability's standard electronic documents only lists security elements by their short names or titles provide example documents that demonstrate how the associated CVE names are listed for each individual security element (required):
From http://xforce.iss.net/xforce/xfdb/6141:
Standards associated with this entry:
CVE-2000-0314: traceroute in NetBSD 1.3.3 and Linux systems allows local users to flood other systems by providing traceroute with a large waittime (-w) option, which is not parsed properly and sets the time delay for sending packets to zero.
33) Electronic Document Element to CVE Name Mapping <CR_B.3.3>
Provide example documents that demonstrate the mapping from the capability's individual elements to the respective CVE name(s) (recommended):
Provide example documents that demonstrate the mapping from the capability's individual elements to the respective CVE name(s) (recommended):
See above example in section 32. A link to the MITRE CVE name in the form https://cve.mitre.org/cgi-bin/cvename.cgi?name=C??-YYYY-NNNN is embedded in each individual element.
34) Finding Elements Using CVE Names Through the GUI <CR_B.4.1>
Give detailed examples and explanations of how the GUI provides a "find" or "search" function for the user to identify your capability's elements by looking for their associated CVE name(s) (required):
X-Force database users may use the World Wide Web to access and search the X-Force database from one or more of the following locations:Enhanced search:
http://xforce.iss.net/xforce/search.php
Index page, listing entries by ISS Tag Name:
35) GUI Element to CVE Name Mapping <CR_B.4.2>
Briefly describe how the associated CVE names are listed for the individual security elements or discuss how the user can use the mapping between CVE entries and the capability's elements, also describe the format of the mapping (required):
<CVE-name><CVE-link>}: <CVE-description>Where:
<CVE-name> := {CVE|CAN}-YYYY-NNNN
<CVE-link> := https://cve.mitre.org/cgi-bin/cvename.cgi?name=<CVE-name>
<CVE-description> := Freeform text available at <CVE-link> in the
Description box.
36) GUI Export Electronic Document Format Info <CR_B.4.3>
Provide details about the different electronic document formats that you provide for exporting or accessing CVE-related data and describe how they can be searched for specific CVE-related text (recommended):
No exporting capability has been implemented or planned for the X-Force database. Export methods are covered under the Terms of Use agreements, applicable Trademark and Intellectual Property laws, and other contractual agreements.All X-Force documents are in HTML and PHP formats. Because these formats consist of plaintext with markup, they are readily searchable by a variety of tools and search engines.
37) Statement of Compatibility <CR_2.7>
Have an authorized individual sign and date the following Compatibility Statement (required):
"As an authorized representative of my organization I agree that we will abide by all of the mandatory CVE Compatibility Requirements as well as all of the additional mandatory CVE Compatibility Requirements that are appropriate for our specific type of capability."
Name: Charles Banton
Title: Site Protector Product Manager
38) Statement of Accuracy <CR_3.4>
Have an authorized individual sign and date the following accuracy Statement (recommended):
"As an authorized representative of my organization and to the best of my knowledge, there are no errors in the mapping between our capability's Repository and the CVE entries our capability identifies."
Name: Luanne Johnson
Title: Team Lead for the X-Force database
39) Statement on False-Positives and False-Negatives <CR_A.2.8 and/or CR_A.3.5>
FOR TOOLS ONLY - Have an authorized individual sign and date the following statement about your tools efficiency in identification of security elements (required):
"As an authorized representative of my organization and to the best of my knowledge, normally when our capability reports a specific security element, it is generally correct and normally when an event occurs that is related to a specific security element our capability generally reports it."
Name: Luanne Johnson
Title: Team Lead for the X-Force database
