Re: Question for MITRE about "Attack Type" in CVE request form

• To: Kurt Seifried <kseifried@redhat.com>
• Subject: Re: Question for MITRE about "Attack Type" in CVE request form
• From: jericho <jericho@attrition.org>
• Date: Mon, 7 Nov 2016 22:00:20 -0600
• Authentication-results: spf=none (sender IP is 129.83.29.2) smtp.mailfrom=LISTS.MITRE.ORG; mitre.mail.onmicrosoft.com; dkim=none (message not signed) header.d=none;mitre.mail.onmicrosoft.com; dmarc=none action=none header.from=attrition.org;mitre.org; dkim=none (message not signed) header.d=none;
• Cc: cve-editorial-board-list <cve-editorial-board-list@lists.mitre.org>
• Delivery-date: Tue Nov 8 06:45:18 2016
• Importance: high
• In-reply-to: <CANO=Ty1zhQ8DenNZqHKH-9hHSdNA7a8FHyz39GxOxJjAg6mjvQ@mail.gmail.com>
• List-help: <mailto:LISTSERV@LISTS.MITRE.ORG?body=INFO%20CVE-EDITORIAL-BOARD-LIST>
• List-owner: <mailto:CVE-EDITORIAL-BOARD-LIST-request@LISTS.MITRE.ORG>
• List-subscribe: <mailto:CVE-EDITORIAL-BOARD-LIST-subscribe-request@LISTS.MITRE.ORG>
• List-unsubscribe: <mailto:CVE-EDITORIAL-BOARD-LIST-unsubscribe-request@LISTS.MITRE.ORG>
• References: <CANO=Ty1zhQ8DenNZqHKH-9hHSdNA7a8FHyz39GxOxJjAg6mjvQ@mail.gmail.com>
• Sender: <owner-cve-editorial-board-list@lists.mitre.org>
• Spamdiagnosticmetadata: 6cdb8bfc89744bd8bfee511e3e65aa05
• Spamdiagnosticoutput: 1:2
• User-agent: Alpine 2.00 (LNX 1167 2008-08-23)

On Mon, 7 Nov 2016, Kurt Seifried wrote:

: You have the values:
: 
: Context-dependent
: 
: Local
: 
: Physical
: 
: Remote
: 
: which doesn't really map to anything like CVSSv2/3 directly, I'm just 
: wondering where this is from?

VulnDB uses the same classifications, and for CVSSv2, Local and Remote 
map. Context-dependent is handled as AV:N / AC:M to denote it requires 
some interaction by the user. Generally, physical is handled with AV:L 
/ 
AC:H.

• References:
  • Question for MITRE about "Attack Type" in CVE request form
    • From: Kurt Seifried <kseifried@redhat.com>

• Prev by Date: Question for MITRE about "Attack Type" in CVE request form
• Next by Date: Agenda for CVE Board Meeting November 16 (Wednesday)
• Previous by thread: Question for MITRE about "Attack Type" in CVE request form
• Next by thread: Agenda for CVE Board Meeting November 16 (Wednesday)
• Index(es):
  • Date
  • Thread