Re: PROPOSAL: Cluster 20 - DESIGN (27 candidates)

[Gene Spafford <spaf@cs.purdue.edu>]

Hmm, interesting.

Suppose we consider a "rule of thumb:"

Any software that functions according to its specification, and whose 
correct functioning is within the bounds of a common security policy 
(but not necessarily *every* policy) will NOT be considered a 
vulnerability for inclusion in the CVE."

Thus, the finger program would not be a vulnerability so long as all 
of its functions are correct and known.   We might allow its use in 
an academic environment, so it is not a vulnerability.

By that token, I would contend that guessable passwords are not a 
vulnerability, either.

Of course, this introduces the question of where do we get complete 
specifications and common policies.... :-)

--spaf