Name of Your Organization:
Symantec Corporation
Web Site:
http://www.symantec.com
Compatible Capability:
SecurityFocus Website
Capability home page:
http://www.securityfocus.com/bid
1) Product Accessibility <CR_2.4>
Provide a short description of how and where your capability is made available to your customers and the public (required):
The SecurityFocus Vulnerability database is a free service for anyone that visits http://www.securityfocus.com/bid or can be accessed via RSS feeds. All data is delayed 72 hours after its initial release to Deepsight Alert services.
4) Map Currency Indication <CR_5.1>
Describe how and where your capability indicates the most recent CVE version used to create or update its mappings (required):
We do not currently state anywhere the most recent version of CVE.
5) Map Currency Update Approach <CR_5.2>
Indicate how often you plan on updating the mappings to reflect new CVE versions and describe your approach to keeping reasonably current with CVE versions when mapping them to your repository (recommended):
Mappings are updated in an automated fashion by obtaining the latest mapping file directly from mitre.org.
6) Map Currency Update Time <CR_5.3>
Describe how and where you explain to your customers the timeframe they should expect an update of your capability's mappings to reflect a newly released CVE version (recommended):
We do not present a time frame for updating CVE mappings in the public vulnerability database.
7) CVE and Compatibility Documentation<CR_4.1>
Provide a copy, or directions to its location, of where your documentation describes CVE and CVE compatibility for your customers (required):
We list CVE as a search option prominently, visible from the vulnerability database search page.
8) Documentation of Finding Elements Using CVE Names <CR_4.2>
Provide a copy, or directions to its location, of where your documentation describes the specific details of how your customers can use CVE names to find the individual security elements within your capability's repository (required):
The public vulnerability database has a visible "search by CVE id" option on the main menu bar.
9) Documentation of Finding CVE Names Using Elements <CR_4.3>
Provide a copy, or directions to its location, of where your documentation describes the process a user would follow to find the CVE names associated with individual security elements within your capability's repository (required):
The CVE name of a vulnerability, if available, is displayed in the "Info" tab of the public vulnerability database.
10) Documentation Indexing of CVE-Related Material <CR_4.4>
If your documentation includes an index, provide a copy of the items and resources that you have listed under "CVE" in your index. Alternately, provide directions to where these "CVE" items are posted on your web site (recommended):
The ability to search by CVE may qualify here as an index. CVE candidate and name entries are also included in Alert Services and as part of our vulnerability database datafeed service.
11) Candidates Versus Entries Indication <CR_6.1>
If CVE candidates are supported or used, explain how you indicate that candidates are not accepted CVE entries (required):
We list the name with the "CAN" prefix.
12) Candidates Versus Entries Explanation <CR_6.2>
If CVE candidates are supported or used, explain where and how the difference between candidates and entries is explained to your customers (recommended):
The public database does not provide any explanation of this, other than using the CAN prefix when the entry is a candidate.
13) Candidate to Entry Promotion <CR_6.3>
If CVE candidates are supported or used, explain your policy for changing candidates into entries within your capability and describe where and how this is communicated to your customers (recommended):
We store both the candidate and the CVE name. Our automatic update process
detects when candidates are promoted to CVE names and inserts them as they
appear.
14) Candidate and Entry Search Support <CR_6.4>
If CVE candidates are supported or used, explain where and how a customer can find the explanation of your search function's ability to look for candidates and entries by using just the YYYY-NNNN portion of the CVE names (recommended):
Our "search by CVE" supports the ability to search using the YYYY-NNNN component of the CVE name. This search option can be used from the public vulnerability database. We do not provide an explanation of this.
15) Search Support for Promoted Candidates <CR_6.5>
If CVE candidates are supported or used, explain where and how a customer can find the explanation of your search function's support for retrieving the CVE entry for a candidate that is no longer a candidate (recommended):
We do not delete candidate entries once it has been promoted. Searches for the candidate name using the search tool will return a valid result. Our documentation does not explain this.
16) Candidate Mapping Currency Indication <CR_6.6>
If CVE candidates are supported or used, explain where and how you tell your users how up-to-date your candidate information is (recommended):
We do not provide any indication about how up-to-date the candidate information is, though we constantly add them as they are issued.
Type-Specific Capability Questions
26) Finding Online Capability Tasks Using CVE Names <CR_A.4.1>
Give detailed examples and explanations of how a "find" or "search" function is available to the user to locate tasks in the online capability by looking for their associated CVE name or through an online mapping that links each element of the capability with its associated CVE name(s) (required):
The user visits the vulnerability database:http://www.securityfocus.com/bid
Clicks "by cve id" in the search menu bar.
The user then inputs the CVE name into the text field and clicks the submit option.Associated vulnerabilities will be presented as the search results.
29) Finding CVE Names Using Online Capability Elements <CR_A.4.2>
Give detailed examples and explanations of how, for reports that identify individual security elements, the online capability allows the user to determine the associated CVE names for the individual security elements in the report (required):
When viewing a vulnerability entry, the user must click on the "info" tab (by default they are in this tab).
The associated CVE name is presented as the key data field "cve".e.g. http://www.securityfocus.com/bid/9138/info
bugtraq id 9138
object class Boundary Condition Error
cve CAN-2003-0961
remote No
local Yes
published Dec 01, 2003
updated Apr 05, 2004
...
31) Electronic Document Format Info <CR_B.3.1>
Provide details about the different electronic document formats that you provide and describe how they can be searched for specific CVE-related text (required):
Vulnerability data is provided in HTML on the SecurityFocus website:http://online.securityfocus.com/bid
The ability to search by CVE name is presented as an option in the vulnerability database menu bar:
"by cve id"
Clicking on this option will take you to a search interface where a complete or partial CVE name or candidate name can be input.
32) Electronic Document Listing of CVE Names <CR_B.3.2>
If one of the capability's standard electronic documents only lists security elements by their short names or titles provide example documents that demonstrate how the associated CVE names are listed for each individual security element (required):
The associated CVE name is listed prominently in the "Info" tab of a vulnerability database entry.
33) Electronic Document Element to CVE Name Mapping <CR_B.3.3>
Provide example documents that demonstrate the mapping from the capability's individual elements to the respective CVE name(s) (recommended):
http://www.securityfocus.com/bid/9138
http://www.securityfocus.com/bid/11021
37) Statement of Compatibility <CR_2.7>
Have an authorized individual sign and date the following Compatibility Statement (required):
"As an authorized representative of my organization I agree that we will abide by all of the mandatory CVE Compatibility Requirements as well as all of the additional mandatory CVE Compatibility Requirements that are appropriate for our specific type of capability."
Name: Geoffrey Boardman
Title: Manager, Development SecurityFocus Symantec Corporation
38) Statement of Accuracy <CR_3.4>
Have an authorized individual sign and date the following accuracy Statement (recommended):
"As an authorized representative of my organization and to the best of my knowledge, there are no errors in the mapping between our capability's Repository and the CVE entries our capability identifies."
Name: Oliver Friedrichs
Title: Senior Manager, Symantec Security Response
39) Statement on False-Positives and False-Negatives <CR_A.2.8 and/or CR_A.3.5>
FOR TOOLS ONLY - Have an authorized individual sign and date the following statement about your tools efficiency in identification of security elements (required):
"As an authorized representative of my organization and to the best of my knowledge, normally when our capability reports a specific security element, it is generally correct and normally when an event occurs that is related to a specific security element our capability generally reports it."
Name: Oliver Friedrichs
Title: Senior Manager, Symantec Security Response
