RE: Should be a CVE?

["Coffin, Chris" <ccoffin@mitre.org>]

• My ability to install/upgrade/downgrade to any software versions does not get a CVE ID, even if what I'm moving to has known CVD IDs.

 

Completely agree with Art on this. Based on the current information, the “install/upgrade/downgrade to any software” issue is not a vulnerability on its own and should not have a CVE ID assigned.

 

• Intel/MITRE should reject the new CVE and update the original. Is this correct?

 

Yes. I believe that this is the most appropriate way to handle the situation. We will be reaching out to our Intel CNA contact for additional information, unless Kent chimes in sooner. J

 

Chris C

 

From: owner-cve-editorial-board-list@lists.mitre.org [mailto:owner-cve-editorial-board-list@lists.mitre.org] On Behalf Of Waltermire, David A. (Fed)
Sent: Tuesday, September 12, 2017 5:32 PM
To: Millar, Thomas <Thomas.Millar@hq.dhs.gov>; Kurt Seifried <kurt@seifried.org>; Art Manion <amanion@cert.org>
Cc: cve-editorial-board-list <cve-editorial-board-list@lists.mitre.org>
Subject: RE: Should be a CVE?

 

This makes sense. So if this is the case, Intel/MITRE should reject the new CVE and update the original. Is this correct?

Dave

-------- Original Message --------
From: "Millar, Thomas" <Thomas.Millar@hq.dhs.gov>
Date: Tue, September 12, 2017 5:49 PM -0400
To: Kurt Seifried <kurt@seifried.org>, Art Manion <amanion@cert.org>
CC: "Waltermire, David A. (Fed)" <david.waltermire@nist.gov>, cve-editorial-board-list@lists.mitre.org
Subject: RE: Should be a CVE?

It should probably be an update to the previous SA & CVE by Intel. The two particular 3XXX firmware versions are not safe, despite what the original advisory stated.



Tom Millar, US-CERT

Sent from +1-202-631-1915
https://www.us-cert.gov

 

---

From: owner-cve-editorial-board-list@lists.mitre.org on behalf of Kurt Seifried
Sent: Tuesday, September 12, 2017 10:44:52 PM
To: Art Manion
Cc: Waltermire, David A. (Fed); cve-editorial-board-list@lists.mitre.org
Subject: Re: Should be a CVE?

I'm not clear, the CVE ID, was it assigned because people are NOT supposed to be able to upgrade or something?

 

By this logic every vendor would need a CVE ID for every software package that can be updated to a version that has a flaw introduced in a later version (so like uhh.. all of them basically). 

 

On Tue, Sep 12, 2017 at 2:01 PM, Art Manion <amanion@cert.org> wrote:

On 2017-09-12 15:19, Waltermire, David A. (Fed) wrote:
> Looking at the following, it appears that a CVE was issued for the potential that someone might upgrade software to a vulnerable version, which has another CVE. I don't think this should qualify as a CVE, given the actual vulnerability already has one.
>
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5698
>
> Should this CVE be rejected?

I think it should be rejected.

Version A1 has vulnerability V1, version B1 has vulnerability V2, V1 and V2 are documented (have CVE IDs), the ability to change from V1 to V2 does not warrant a CVE ID.

My ability to install/upgrade/downgrade to any software versions does not get a CVE ID, even if what I'm moving to has known CVD IDs.

Intel is welcome to release an advisory, upgrading and being newly/differently vulnerable is unexpected, which goes to the core of many vulnerability/security issues.  But no CVE ID.

 - Art

 

--

Kurt Seifried
kurt@seifried.org