[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: CNA Rules Announcement

On Sun, 9 Oct 2016, Chandan Nandakumaraiah wrote:

: On 10/9/16 1:08 PM, jericho wrote:
: > While many may immediately say "we don't need 100 IDs for that, 
: > confusing!" I disagree to at a certain point. When it comes to 
: > fixes where you are applying 20 different patches, upgrades, or 
: > workarounds in your organization "for the same vulnerability", that 
: > confusing. That one ID is no longer talking about the same 
: > in the full scope of it (flaw, impact, and remediation).
: CVE's core value is in the ability to name vulnerabilities - not 
: patches, upgrades or workarounds.
: This is similar to how we name hurricanes or medical conditions: we 
: don't name the same medical condition differently based on medicines 
: used to treat it, or people it affects. If we have to send 20 rescue 
: missions to respond to hurricane Matthew, naming the hurricane 
: differently for each response mission isn't going to help.
: If there is a need to name (i.e assign unique id to) each patch or 
: upgrade then that should not be mixed up with 'Common Vulnerability 
: Enumeration'. We will need something named liked a 'Vulnerability 
: Remediation Enumeration'.

You are right, but jump back in the thread. If the vulnerability is in 
protocol specs, it deserves one ID. That is *one* base vulnerability 
is inherited by any product implementing the protocol based on the 

If you want to then turnaround and issue one ID for implementation 
when the protocol spec is correct, you aren't being consistent. At that 
point having different IDs speaks to the different patches, but it 
abstracted *because* of the different patches. Subtle, but important 

I honestly don't much care which way it goes. One ID, abstract by 
whatever. The important part is to stay consistent in the handling of 
issues. MITRE has largely been consistent on this, with a few outliers 
(all understandable as best I recall). If MITRE and the Board decide to 
change that, it should be a unified decision that is clearly stated 

Again, I see the benefit of each method and unfortunately, the benefits 
each way help different types of InfoSec professionals. If we go one 
we please academics, (some) VDBs, and (some) auditors. If we go the 
way, we please system admins, (some) VDBs, and (some) auditors.


Page Last Updated or Reviewed: October 10, 2016